theory Example_Valid_StateH

lemma s0_srel:
  "1 \<le> maxDomain \<Longrightarrow> (s0_internal, s0H_internal) \<in> state_relation" apply (simp add: state_relation_def) apply (intro conjI) apply (simp add: s0_pspace_rel) apply (clarsimp simp: ekheap_relation_def) apply (case_tac "ksPSpace s0H_internal x") apply (clarsimp simp: s0_internal_def s0H_internal_def exst0_def kh0H_def option_update_range_def split: if_split_asm option.splits) apply (clarsimp simp: s0_internal_def s0H_internal_def exst0_def etcb_relation_def idle_tcbH_def High_tcbH_def High_etcb_def Low_tcbH_def Low_etcb_def default_etcb_def split: if_split_asm) apply (simp add: s0_internal_def exst0_def s0H_internal_def sched_act_relation_def) apply (simp add: s0_internal_def exst0_def s0H_internal_def ready_queues_relation_def) apply (clarsimp simp: s0_internal_def exst0_def s0H_internal_def ghost_relation_def) apply (rule conjI) apply clarsimp apply (rule conjI) apply (clarsimp simp: kh0_def s0_ptr_defs) apply clarsimp apply (drule kh0_SomeD) apply (clarsimp simp: s0_ptr_defs kh0_obj_def) apply clarsimp apply (rule conjI) apply clarsimp apply (rule iffI) apply clarsimp apply (drule kh0_SomeD) apply (clarsimp simp: irq_node_offs_in_range) apply (fastforce simp: kh0_def well_formed_cnode_n_def empty_cnode_def dom_def) apply clarsimp apply (clarsimp simp: s0_ptr_defs) apply (subgoal_tac "a \<notin> irq_node_offs_range") prefer 2 apply (clarsimp simp: irq_node_offs_range_def s0_ptr_defs cte_level_bits_def) apply (erule_tac x="ucast (a - 0xE0008000 >> 4)" in allE) apply (subst(asm) ucast_ucast_len) apply (rule shiftr_less_t2n) apply (rule word_less_sub_right) apply simp apply simp apply (simp add: shiftr_shiftl1) apply (subst(asm) is_aligned_neg_mask_eq) apply (rule aligned_sub_aligned[where n=4]) apply simp apply (simp add: is_aligned_def) apply simp apply simp apply (intro conjI impI) apply clarsimp apply (rule iffI) apply clarsimp apply (drule kh0_SomeD) apply (clarsimp simp: s0_ptr_defs kh0_obj_def) apply (fastforce simp: kh0_def well_formed_cnode_n_def empty_cnode_def dom_def s0_ptr_defs kh0_obj_def Low_caps_def) apply clarsimp apply (rule iffI) apply clarsimp apply (drule kh0_SomeD) apply (clarsimp simp: s0_ptr_defs kh0_obj_def) apply (fastforce simp: kh0_def well_formed_cnode_n_def empty_cnode_def dom_def s0_ptr_defs kh0_obj_def High_caps_def) apply clarsimp apply (rule iffI) apply clarsimp apply (drule kh0_SomeD) apply (clarsimp simp: s0_ptr_defs kh0_obj_def) apply (fastforce simp: kh0_def well_formed_cnode_n_def empty_cnode_def dom_def s0_ptr_defs kh0_obj_def Silc_caps_def) apply clarsimp apply (rule iffI) apply clarsimp apply (drule kh0_SomeD) apply (clarsimp simp: s0_ptr_defs kh0_obj_def) apply (fastforce simp: kh0_def well_formed_cnode_n_def empty_cnode_def dom_def s0_ptr_defs kh0_obj_def Silc_caps_def) apply clarsimp apply (drule kh0_SomeD) apply (clarsimp simp: s0_ptr_defs kh0_obj_def) apply (clarsimp simp: s0H_internal_def cdt_relation_def) apply (clarsimp simp: descendants_of'_def) apply (frule subtree_parent) apply (drule subtree_mdb_next) apply (case_tac "x = 0") apply (cut_tac s0H_valid_pspace') apply (simp add: valid_pspace'_def valid_mdb'_def valid_mdb_ctes_def parentOf_def isMDBParentOf_def kh0H_all_obj_def') apply simp apply (clarsimp simp: mdb_next_trancl_s0H) apply (elim disjE, (clarsimp simp: parentOf_def isMDBParentOf_def kh0H_all_obj_def')+)[1] apply (clarsimp simp: cdt_list_relation_def s0_internal_def exst0_def split: option.splits) apply (clarsimp simp: next_slot_def) apply (cut_tac p="(a, b)" and t="(const [])" and m="Map.empty" in next_not_child_NoneI) apply fastforce apply (simp add: next_sib_def) apply (simp add: finite_depth_def) apply simp apply (clarsimp simp: revokable_relation_def) apply (clarsimp simp: null_filter_def split: if_split_asm) apply (drule s0_caps_of_state) apply clarsimp apply (elim disjE) apply (clarsimp simp: cte_map_def s0H_internal_def s0_internal_def kh0H_all_obj_def' cte_level_bits_def split: if_split_asm)+ apply (clarsimp simp: tcb_cnode_index_def ucast_bl[symmetric] Low_tcb_cte_def Low_tcbH_def High_tcb_cte_def High_tcbH_def) apply ((clarsimp simp: cte_map_def' s0H_internal_def s0_internal_def,
                       clarsimp simp: tcb_cnode_index_def ucast_bl[symmetric] Low_tcb_cte_def Low_tcbH_def High_tcb_cte_def High_tcbH_def)+)[5] apply (clarsimp simp: s0_internal_def s0H_internal_def arch_state_relation_def arch_state0_def arch_state0H_def) apply (clarsimp simp: s0_internal_def exst0_def s0H_internal_def interrupt_state_relation_def irq_state_relation_def) apply (clarsimp simp: s0_internal_def exst0_def s0H_internal_def)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> (s0_internal, s0H_internal) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> pspace_relation (kheap s0_internal) kh0H \<and> ekheap_relation (ekheap s0_internal) kh0H \<and> sched_act_relation (scheduler_action s0_internal) (ksSchedulerAction s0H_internal) \<and> ready_queues_relation (ready_queues s0_internal) (ksReadyQueues s0H_internal) \<and> ghost_relation (kheap s0_internal) (gsUserPages s0H_internal) (gsCNodes s0H_internal) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H) \<and> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H) \<and> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H) \<and> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal) \<and> cur_thread s0_internal = ksCurThread s0H_internal \<and> idle_thread s0_internal = ksIdleThread s0H_internal \<and> machine_state s0_internal = ksMachineState s0H_internal \<and> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal \<and> domain_index s0_internal = ksDomScheduleIdx s0H_internal \<and> domain_list s0_internal = ksDomSchedule s0H_internal \<and> cur_domain s0_internal = ksCurDomain s0H_internal \<and> domain_time s0_internal = ksDomainTime s0H_internal proof (prove)
goal (18 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> pspace_relation (kheap s0_internal) kh0H
 2. 1 \<le> maxDomain \<Longrightarrow> ekheap_relation (ekheap s0_internal) kh0H
 3. 1 \<le> maxDomain \<Longrightarrow> sched_act_relation (scheduler_action s0_internal) (ksSchedulerAction s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> ready_queues_relation (ready_queues s0_internal) (ksReadyQueues s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> ghost_relation (kheap s0_internal) (gsUserPages s0H_internal) (gsCNodes s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 10. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> ekheap_relation (ekheap s0_internal) kh0H
 2. 1 \<le> maxDomain \<Longrightarrow> sched_act_relation (scheduler_action s0_internal) (ksSchedulerAction s0H_internal)
 3. 1 \<le> maxDomain \<Longrightarrow> ready_queues_relation (ready_queues s0_internal) (ksReadyQueues s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> ghost_relation (kheap s0_internal) (gsUserPages s0H_internal) (gsCNodes s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 9. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; ekheap s0_internal x = Some y\<rbrakk> \<Longrightarrow> \<exists>tcb'. kh0H x = Some (KOTCB tcb') \<and> etcb_relation y tcb'
 2. 1 \<le> maxDomain \<Longrightarrow> sched_act_relation (scheduler_action s0_internal) (ksSchedulerAction s0H_internal)
 3. 1 \<le> maxDomain \<Longrightarrow> ready_queues_relation (ready_queues s0_internal) (ksReadyQueues s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> ghost_relation (kheap s0_internal) (gsUserPages s0H_internal) (gsCNodes s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 9. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; ekheap s0_internal x = Some y; ksPSpace s0H_internal x = None\<rbrakk> \<Longrightarrow> \<exists>tcb'. kh0H x = Some (KOTCB tcb') \<and> etcb_relation y tcb'
 2. \<And>x y a. \<lbrakk>1 \<le> maxDomain; ekheap s0_internal x = Some y; ksPSpace s0H_internal x = Some a\<rbrakk> \<Longrightarrow> \<exists>tcb'. kh0H x = Some (KOTCB tcb') \<and> etcb_relation y tcb'
 3. 1 \<le> maxDomain \<Longrightarrow> sched_act_relation (scheduler_action s0_internal) (ksSchedulerAction s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> ready_queues_relation (ready_queues s0_internal) (ksReadyQueues s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> ghost_relation (kheap s0_internal) (gsUserPages s0H_internal) (gsCNodes s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 10. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x y a. \<lbrakk>1 \<le> maxDomain; ekheap s0_internal x = Some y; ksPSpace s0H_internal x = Some a\<rbrakk> \<Longrightarrow> \<exists>tcb'. kh0H x = Some (KOTCB tcb') \<and> etcb_relation y tcb'
 2. 1 \<le> maxDomain \<Longrightarrow> sched_act_relation (scheduler_action s0_internal) (ksSchedulerAction s0H_internal)
 3. 1 \<le> maxDomain \<Longrightarrow> ready_queues_relation (ready_queues s0_internal) (ksReadyQueues s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> ghost_relation (kheap s0_internal) (gsUserPages s0H_internal) (gsCNodes s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 9. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> sched_act_relation (scheduler_action s0_internal) (ksSchedulerAction s0H_internal)
 2. 1 \<le> maxDomain \<Longrightarrow> ready_queues_relation (ready_queues s0_internal) (ksReadyQueues s0H_internal)
 3. 1 \<le> maxDomain \<Longrightarrow> ghost_relation (kheap s0_internal) (gsUserPages s0H_internal) (gsCNodes s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> ready_queues_relation (ready_queues s0_internal) (ksReadyQueues s0H_internal)
 2. 1 \<le> maxDomain \<Longrightarrow> ghost_relation (kheap s0_internal) (gsUserPages s0H_internal) (gsCNodes s0H_internal)
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> ghost_relation (kheap s0_internal) (gsUserPages s0H_internal) (gsCNodes s0H_internal)
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> (\<forall>a. (a = init_globals_frame \<longrightarrow> (\<forall>sz. (\<exists>dev. kh0 init_globals_frame = Some (ArchObj (DataPage dev sz))) = (ARMSmallPage = sz))) \<and> (a \<noteq> init_globals_frame \<longrightarrow> (\<forall>sz dev. kh0 a \<noteq> Some (ArchObj (DataPage dev sz))))) \<and> (\<forall>a. ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 a = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))))))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))))
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> \<forall>a. (a = init_globals_frame \<longrightarrow> (\<forall>sz. (\<exists>dev. kh0 init_globals_frame = Some (ArchObj (DataPage dev sz))) = (ARMSmallPage = sz))) \<and> (a \<noteq> init_globals_frame \<longrightarrow> (\<forall>sz dev. kh0 a \<noteq> Some (ArchObj (DataPage dev sz))))
 2. 1 \<le> maxDomain \<Longrightarrow> \<forall>a. ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 a = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))))))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs))))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a. 1 \<le> maxDomain \<Longrightarrow> (a = init_globals_frame \<longrightarrow> (\<forall>sz. (\<exists>dev. kh0 init_globals_frame = Some (ArchObj (DataPage dev sz))) = (ARMSmallPage = sz))) \<and> (a \<noteq> init_globals_frame \<longrightarrow> (\<forall>sz dev. kh0 a \<noteq> Some (ArchObj (DataPage dev sz))))
 2. 1 \<le> maxDomain \<Longrightarrow> \<forall>a. ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 a = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))))))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs))))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a. 1 \<le> maxDomain \<Longrightarrow> a = init_globals_frame \<longrightarrow> (\<forall>sz. (\<exists>dev. kh0 init_globals_frame = Some (ArchObj (DataPage dev sz))) = (ARMSmallPage = sz))
 2. \<And>a. 1 \<le> maxDomain \<Longrightarrow> a \<noteq> init_globals_frame \<longrightarrow> (\<forall>sz dev. kh0 a \<noteq> Some (ArchObj (DataPage dev sz)))
 3. 1 \<le> maxDomain \<Longrightarrow> \<forall>a. ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 a = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))))))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs))))))
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a. 1 \<le> maxDomain \<Longrightarrow> a \<noteq> init_globals_frame \<longrightarrow> (\<forall>sz dev. kh0 a \<noteq> Some (ArchObj (DataPage dev sz)))
 2. 1 \<le> maxDomain \<Longrightarrow> \<forall>a. ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 a = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))))))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs))))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a sz dev. \<lbrakk>1 \<le> maxDomain; a \<noteq> init_globals_frame; kh0 a = Some (ArchObj (DataPage dev sz))\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> \<forall>a. ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 a = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))))))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs))))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a sz dev. \<lbrakk>1 \<le> maxDomain; a \<noteq> init_globals_frame; a = init_globals_frame \<and> ArchObj (DataPage dev sz) = ArchObj (DataPage False ARMSmallPage) \<or> a = init_global_pd \<and> ArchObj (DataPage dev sz) = ArchObj (PageDirectory global_pd) \<or> a = idle_tcb_ptr \<and> ArchObj (DataPage dev sz) = idle_tcb \<or> a = High_tcb_ptr \<and> ArchObj (DataPage dev sz) = High_tcb \<or> a = Low_tcb_ptr \<and> ArchObj (DataPage dev sz) = Low_tcb \<or> a = High_pt_ptr \<and> ArchObj (DataPage dev sz) = High_pt \<or> a = Low_pt_ptr \<and> ArchObj (DataPage dev sz) = Low_pt \<or> a = High_pd_ptr \<and> ArchObj (DataPage dev sz) = High_pd \<or> a = Low_pd_ptr \<and> ArchObj (DataPage dev sz) = Low_pd \<or> a = irq_cnode_ptr \<and> ArchObj (DataPage dev sz) = irq_cnode \<or> a = ntfn_ptr \<and> ArchObj (DataPage dev sz) = ntfn \<or> a = Silc_cnode_ptr \<and> ArchObj (DataPage dev sz) = Silc_cnode \<or> a = High_cnode_ptr \<and> ArchObj (DataPage dev sz) = High_cnode \<or> a = Low_cnode_ptr \<and> ArchObj (DataPage dev sz) = Low_cnode \<or> a \<in> irq_node_offs_range \<and> ArchObj (DataPage dev sz) = CNode 0 (empty_cnode 0)\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> \<forall>a. ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 a = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))))))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs))))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> \<forall>a. ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 a = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))))))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs))))))
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a. 1 \<le> maxDomain \<Longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 a = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))))))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs))))))
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a. 1 \<le> maxDomain \<Longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 a = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))))))
 2. \<And>a. 1 \<le> maxDomain \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>irq n. 1 \<le> maxDomain \<Longrightarrow> (\<exists>cs. kh0 (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 2. \<And>a. 1 \<le> maxDomain \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>irq n. \<lbrakk>1 \<le> maxDomain; \<exists>cs. kh0 (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) = Some (CNode n cs) \<and> well_formed_cnode_n n cs\<rbrakk> \<Longrightarrow> n = 0
 2. \<And>irq n. \<lbrakk>1 \<le> maxDomain; n = 0\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. 1 \<le> maxDomain \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>irq n cs. \<lbrakk>1 \<le> maxDomain; kh0 (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) = Some (CNode n cs); well_formed_cnode_n n cs\<rbrakk> \<Longrightarrow> n = 0
 2. \<And>irq n. \<lbrakk>1 \<le> maxDomain; n = 0\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. 1 \<le> maxDomain \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>irq n cs. \<lbrakk>1 \<le> maxDomain; well_formed_cnode_n n cs; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = init_globals_frame \<and> CNode n cs = ArchObj (DataPage False ARMSmallPage) \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = init_global_pd \<and> CNode n cs = ArchObj (PageDirectory global_pd) \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr \<and> CNode n cs = idle_tcb \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr \<and> CNode n cs = High_tcb \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr \<and> CNode n cs = Low_tcb \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_pt_ptr \<and> CNode n cs = High_pt \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_pt_ptr \<and> CNode n cs = Low_pt \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_pd_ptr \<and> CNode n cs = High_pd \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_pd_ptr \<and> CNode n cs = Low_pd \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = irq_cnode_ptr \<and> CNode n cs = irq_cnode \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = ntfn_ptr \<and> CNode n cs = ntfn \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Silc_cnode_ptr \<and> CNode n cs = Silc_cnode \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_cnode_ptr \<and> CNode n cs = High_cnode \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_cnode_ptr \<and> CNode n cs = Low_cnode \<or> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range \<and> CNode n cs = CNode 0 (empty_cnode 0)\<rbrakk> \<Longrightarrow> n = 0
 2. \<And>irq n. \<lbrakk>1 \<le> maxDomain; n = 0\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. 1 \<le> maxDomain \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>irq n. \<lbrakk>1 \<le> maxDomain; n = 0\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 2. \<And>a. 1 \<le> maxDomain \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a. 1 \<le> maxDomain \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a) \<longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a\<rbrakk> \<Longrightarrow> (a = Low_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Low_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Low_cnode_ptr \<longrightarrow> (a = High_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 High_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> High_cnode_ptr \<longrightarrow> (a = Silc_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 Silc_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> Silc_cnode_ptr \<longrightarrow> (a = irq_cnode_ptr \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 irq_cnode_ptr = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a\<rbrakk> \<Longrightarrow> a \<notin> irq_node_offs_range
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a\<rbrakk> \<Longrightarrow> a \<notin> irq_node_offs_range
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) \<noteq> a; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> False
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4; 0xE0008000 + (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) (a - 0xE0008000 >> 4)) << 4) \<noteq> a\<rbrakk> \<Longrightarrow> False
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> a - 0xE0008000 >> 4 < 2 ^ LENGTH(10)
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4; 0xE0008000 + (a - 0xE0008000 >> 4 << 4) \<noteq> a\<rbrakk> \<Longrightarrow> False
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> a - 0xE0008000 < 2 ^ (4 + LENGTH(10))
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4; 0xE0008000 + (a - 0xE0008000 >> 4 << 4) \<noteq> a\<rbrakk> \<Longrightarrow> False
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> a < 0xE0008000 + 2 ^ (4 + LENGTH(10))
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> 0xE0008000 \<le> a
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4; 0xE0008000 + (a - 0xE0008000 >> 4 << 4) \<noteq> a\<rbrakk> \<Longrightarrow> False
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 9. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> 0xE0008000 \<le> a
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4; 0xE0008000 + (a - 0xE0008000 >> 4 << 4) \<noteq> a\<rbrakk> \<Longrightarrow> False
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4; 0xE0008000 + (a - 0xE0008000 >> 4 << 4) \<noteq> a\<rbrakk> \<Longrightarrow> False
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4; 0xE0008000 + (a - 0xE0008000 && ~~ mask 4) \<noteq> a\<rbrakk> \<Longrightarrow> False
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> is_aligned (a - 0xE0008000) 4
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4; 0xE0008000 + (a - 0xE0008000) \<noteq> a\<rbrakk> \<Longrightarrow> False
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> is_aligned a 4
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> is_aligned 0xE0008000 4
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> 4 < LENGTH(32)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4; 0xE0008000 + (a - 0xE0008000) \<noteq> a\<rbrakk> \<Longrightarrow> False
 5. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 10. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> is_aligned 0xE0008000 4
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> 4 < LENGTH(32)
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4; 0xE0008000 + (a - 0xE0008000) \<noteq> a\<rbrakk> \<Longrightarrow> False
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 9. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4\<rbrakk> \<Longrightarrow> 4 < LENGTH(32)
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4; 0xE0008000 + (a - 0xE0008000) \<noteq> a\<rbrakk> \<Longrightarrow> False
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; a < 0xE000C000; 0xE0008000 \<le> a; is_aligned a 4; 0xE0008000 + (a - 0xE0008000) \<noteq> a\<rbrakk> \<Longrightarrow> False
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (a = 0xE0010000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0010000 \<longrightarrow> (a = 0xE0014000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0014000 \<longrightarrow> (a = 0xE0018000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10))) \<and> (a \<noteq> 0xE0018000 \<longrightarrow> (a = 0xE001C000 \<longrightarrow> (\<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0))) \<and> (a \<noteq> 0xE001C000 \<longrightarrow> (\<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs)))))
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a = 0xE0010000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a = 0xE0014000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 5. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 10. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x8000; 0xE0010000 \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (\<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a = 0xE0014000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 5. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 10. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x8000; 0xE0010000 \<notin> irq_node_offs_range; \<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs\<rbrakk> \<Longrightarrow> n = 10
 2. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x8000; 0xE0010000 \<notin> irq_node_offs_range; n = 10\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a = 0xE0014000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 5. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 6. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 7. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>n cs. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x8000; 0xE0010000 \<notin> irq_node_offs_range; kh0 0xE0010000 = Some (CNode n cs); well_formed_cnode_n n cs\<rbrakk> \<Longrightarrow> n = 10
 2. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x8000; 0xE0010000 \<notin> irq_node_offs_range; n = 10\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a = 0xE0014000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 5. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 6. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 7. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>n cs. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x8000; 0xE0010000 \<notin> irq_node_offs_range; well_formed_cnode_n n cs; 0xE0010000 = init_globals_frame \<and> CNode n cs = ArchObj (DataPage False ARMSmallPage) \<or> 0xE0010000 = init_global_pd \<and> CNode n cs = ArchObj (PageDirectory global_pd) \<or> 0xE0010000 = idle_tcb_ptr \<and> CNode n cs = idle_tcb \<or> 0xE0010000 = High_tcb_ptr \<and> CNode n cs = High_tcb \<or> 0xE0010000 = Low_tcb_ptr \<and> CNode n cs = Low_tcb \<or> 0xE0010000 = High_pt_ptr \<and> CNode n cs = High_pt \<or> 0xE0010000 = Low_pt_ptr \<and> CNode n cs = Low_pt \<or> 0xE0010000 = High_pd_ptr \<and> CNode n cs = High_pd \<or> 0xE0010000 = Low_pd_ptr \<and> CNode n cs = Low_pd \<or> 0xE0010000 = irq_cnode_ptr \<and> CNode n cs = irq_cnode \<or> 0xE0010000 = ntfn_ptr \<and> CNode n cs = ntfn \<or> 0xE0010000 = Silc_cnode_ptr \<and> CNode n cs = Silc_cnode \<or> 0xE0010000 = High_cnode_ptr \<and> CNode n cs = High_cnode \<or> 0xE0010000 = Low_cnode_ptr \<and> CNode n cs = Low_cnode \<or> 0xE0010000 \<in> irq_node_offs_range \<and> CNode n cs = CNode 0 (empty_cnode 0)\<rbrakk> \<Longrightarrow> n = 10
 2. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x8000; 0xE0010000 \<notin> irq_node_offs_range; n = 10\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a = 0xE0014000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 5. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 6. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 7. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x8000; 0xE0010000 \<notin> irq_node_offs_range; n = 10\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE0010000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a = 0xE0014000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 5. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 10. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a = 0xE0014000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 9. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0xC000; 0xE0014000 \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (\<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 9. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0xC000; 0xE0014000 \<notin> irq_node_offs_range; \<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs\<rbrakk> \<Longrightarrow> n = 10
 2. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0xC000; 0xE0014000 \<notin> irq_node_offs_range; n = 10\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 5. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 10. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>n cs. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0xC000; 0xE0014000 \<notin> irq_node_offs_range; kh0 0xE0014000 = Some (CNode n cs); well_formed_cnode_n n cs\<rbrakk> \<Longrightarrow> n = 10
 2. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0xC000; 0xE0014000 \<notin> irq_node_offs_range; n = 10\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 5. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 10. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>n cs. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0xC000; 0xE0014000 \<notin> irq_node_offs_range; well_formed_cnode_n n cs; 0xE0014000 = init_globals_frame \<and> CNode n cs = ArchObj (DataPage False ARMSmallPage) \<or> 0xE0014000 = init_global_pd \<and> CNode n cs = ArchObj (PageDirectory global_pd) \<or> 0xE0014000 = idle_tcb_ptr \<and> CNode n cs = idle_tcb \<or> 0xE0014000 = High_tcb_ptr \<and> CNode n cs = High_tcb \<or> 0xE0014000 = Low_tcb_ptr \<and> CNode n cs = Low_tcb \<or> 0xE0014000 = High_pt_ptr \<and> CNode n cs = High_pt \<or> 0xE0014000 = Low_pt_ptr \<and> CNode n cs = Low_pt \<or> 0xE0014000 = High_pd_ptr \<and> CNode n cs = High_pd \<or> 0xE0014000 = Low_pd_ptr \<and> CNode n cs = Low_pd \<or> 0xE0014000 = irq_cnode_ptr \<and> CNode n cs = irq_cnode \<or> 0xE0014000 = ntfn_ptr \<and> CNode n cs = ntfn \<or> 0xE0014000 = Silc_cnode_ptr \<and> CNode n cs = Silc_cnode \<or> 0xE0014000 = High_cnode_ptr \<and> CNode n cs = High_cnode \<or> 0xE0014000 = Low_cnode_ptr \<and> CNode n cs = Low_cnode \<or> 0xE0014000 \<in> irq_node_offs_range \<and> CNode n cs = CNode 0 (empty_cnode 0)\<rbrakk> \<Longrightarrow> n = 10
 2. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0xC000; 0xE0014000 \<notin> irq_node_offs_range; n = 10\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 5. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 10. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0xC000; 0xE0014000 \<notin> irq_node_offs_range; n = 10\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE0014000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 9. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a = 0xE0018000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x10000; 0xE0018000 \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (\<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 10)
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x10000; 0xE0018000 \<notin> irq_node_offs_range; \<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs\<rbrakk> \<Longrightarrow> n = 10
 2. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x10000; 0xE0018000 \<notin> irq_node_offs_range; n = 10\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 9. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>n cs. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x10000; 0xE0018000 \<notin> irq_node_offs_range; kh0 0xE0018000 = Some (CNode n cs); well_formed_cnode_n n cs\<rbrakk> \<Longrightarrow> n = 10
 2. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x10000; 0xE0018000 \<notin> irq_node_offs_range; n = 10\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 9. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>n cs. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x10000; 0xE0018000 \<notin> irq_node_offs_range; well_formed_cnode_n n cs; 0xE0018000 = init_globals_frame \<and> CNode n cs = ArchObj (DataPage False ARMSmallPage) \<or> 0xE0018000 = init_global_pd \<and> CNode n cs = ArchObj (PageDirectory global_pd) \<or> 0xE0018000 = idle_tcb_ptr \<and> CNode n cs = idle_tcb \<or> 0xE0018000 = High_tcb_ptr \<and> CNode n cs = High_tcb \<or> 0xE0018000 = Low_tcb_ptr \<and> CNode n cs = Low_tcb \<or> 0xE0018000 = High_pt_ptr \<and> CNode n cs = High_pt \<or> 0xE0018000 = Low_pt_ptr \<and> CNode n cs = Low_pt \<or> 0xE0018000 = High_pd_ptr \<and> CNode n cs = High_pd \<or> 0xE0018000 = Low_pd_ptr \<and> CNode n cs = Low_pd \<or> 0xE0018000 = irq_cnode_ptr \<and> CNode n cs = irq_cnode \<or> 0xE0018000 = ntfn_ptr \<and> CNode n cs = ntfn \<or> 0xE0018000 = Silc_cnode_ptr \<and> CNode n cs = Silc_cnode \<or> 0xE0018000 = High_cnode_ptr \<and> CNode n cs = High_cnode \<or> 0xE0018000 = Low_cnode_ptr \<and> CNode n cs = Low_cnode \<or> 0xE0018000 \<in> irq_node_offs_range \<and> CNode n cs = CNode 0 (empty_cnode 0)\<rbrakk> \<Longrightarrow> n = 10
 2. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x10000; 0xE0018000 \<notin> irq_node_offs_range; n = 10\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 4. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 9. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x10000; 0xE0018000 \<notin> irq_node_offs_range; n = 10\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE0018000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a = 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n. (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x14000; 0xE001C000 \<notin> irq_node_offs_range\<rbrakk> \<Longrightarrow> (\<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (n = 0)
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x14000; 0xE001C000 \<notin> irq_node_offs_range; \<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs\<rbrakk> \<Longrightarrow> n = 0
 2. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x14000; 0xE001C000 \<notin> irq_node_offs_range; n = 0\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>n cs. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x14000; 0xE001C000 \<notin> irq_node_offs_range; kh0 0xE001C000 = Some (CNode n cs); well_formed_cnode_n n cs\<rbrakk> \<Longrightarrow> n = 0
 2. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x14000; 0xE001C000 \<notin> irq_node_offs_range; n = 0\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>n cs. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x14000; 0xE001C000 \<notin> irq_node_offs_range; well_formed_cnode_n n cs; 0xE001C000 = init_globals_frame \<and> CNode n cs = ArchObj (DataPage False ARMSmallPage) \<or> 0xE001C000 = init_global_pd \<and> CNode n cs = ArchObj (PageDirectory global_pd) \<or> 0xE001C000 = idle_tcb_ptr \<and> CNode n cs = idle_tcb \<or> 0xE001C000 = High_tcb_ptr \<and> CNode n cs = High_tcb \<or> 0xE001C000 = Low_tcb_ptr \<and> CNode n cs = Low_tcb \<or> 0xE001C000 = High_pt_ptr \<and> CNode n cs = High_pt \<or> 0xE001C000 = Low_pt_ptr \<and> CNode n cs = Low_pt \<or> 0xE001C000 = High_pd_ptr \<and> CNode n cs = High_pd \<or> 0xE001C000 = Low_pd_ptr \<and> CNode n cs = Low_pd \<or> 0xE001C000 = irq_cnode_ptr \<and> CNode n cs = irq_cnode \<or> 0xE001C000 = ntfn_ptr \<and> CNode n cs = ntfn \<or> 0xE001C000 = Silc_cnode_ptr \<and> CNode n cs = Silc_cnode \<or> 0xE001C000 = High_cnode_ptr \<and> CNode n cs = High_cnode \<or> 0xE001C000 = Low_cnode_ptr \<and> CNode n cs = Low_cnode \<or> 0xE001C000 \<in> irq_node_offs_range \<and> CNode n cs = CNode 0 (empty_cnode 0)\<rbrakk> \<Longrightarrow> n = 0
 2. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x14000; 0xE001C000 \<notin> irq_node_offs_range; n = 0\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>n. \<lbrakk>1 \<le> maxDomain; \<forall>irq. UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<noteq> 0x14000; 0xE001C000 \<notin> irq_node_offs_range; n = 0\<rbrakk> \<Longrightarrow> \<exists>cs. kh0 0xE001C000 = Some (CNode n cs) \<and> well_formed_cnode_n n cs
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000\<rbrakk> \<Longrightarrow> \<forall>n cs. kh0 a = Some (CNode n cs) \<longrightarrow> \<not> well_formed_cnode_n n cs
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a n cs. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000; kh0 a = Some (CNode n cs); well_formed_cnode_n n cs\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a n cs. \<lbrakk>1 \<le> maxDomain; \<forall>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> a; a \<notin> irq_node_offs_range; a \<noteq> 0xE0010000; a \<noteq> 0xE0014000; a \<noteq> 0xE0018000; a \<noteq> 0xE001C000; well_formed_cnode_n n cs; a = init_globals_frame \<and> CNode n cs = ArchObj (DataPage False ARMSmallPage) \<or> a = init_global_pd \<and> CNode n cs = ArchObj (PageDirectory global_pd) \<or> a = idle_tcb_ptr \<and> CNode n cs = idle_tcb \<or> a = High_tcb_ptr \<and> CNode n cs = High_tcb \<or> a = Low_tcb_ptr \<and> CNode n cs = Low_tcb \<or> a = High_pt_ptr \<and> CNode n cs = High_pt \<or> a = Low_pt_ptr \<and> CNode n cs = Low_pt \<or> a = High_pd_ptr \<and> CNode n cs = High_pd \<or> a = Low_pd_ptr \<and> CNode n cs = Low_pd \<or> a = irq_cnode_ptr \<and> CNode n cs = irq_cnode \<or> a = ntfn_ptr \<and> CNode n cs = ntfn \<or> a = Silc_cnode_ptr \<and> CNode n cs = Silc_cnode \<or> a = High_cnode_ptr \<and> CNode n cs = High_cnode \<or> a = Low_cnode_ptr \<and> CNode n cs = Low_cnode \<or> a \<in> irq_node_offs_range \<and> CNode n cs = CNode 0 (empty_cnode 0)\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 5. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal\<rbrakk> \<Longrightarrow> {} = descendants_of' (cte_map (a, b)) (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 5. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b x. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal; map_to_ctes kh0H \<turnstile> cte_map (a, b) \<rightarrow> x\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 5. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b x. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal; map_to_ctes kh0H \<turnstile> cte_map (a, b) \<rightarrow> x; map_to_ctes kh0H \<turnstile> cte_map (a, b) parentOf x\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 5. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b x. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal; map_to_ctes kh0H \<turnstile> cte_map (a, b) parentOf x; map_to_ctes kh0H \<turnstile> cte_map (a, b) \<leadsto>\<^sup>+ x\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 5. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a b x. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal; map_to_ctes kh0H \<turnstile> cte_map (a, b) parentOf x; map_to_ctes kh0H \<turnstile> cte_map (a, b) \<leadsto>\<^sup>+ x; x = 0\<rbrakk> \<Longrightarrow> False
 2. \<And>a b x. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal; map_to_ctes kh0H \<turnstile> cte_map (a, b) parentOf x; map_to_ctes kh0H \<turnstile> cte_map (a, b) \<leadsto>\<^sup>+ x; x \<noteq> 0\<rbrakk> \<Longrightarrow> False
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b x. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal; map_to_ctes kh0H \<turnstile> cte_map (a, b) parentOf x; map_to_ctes kh0H \<turnstile> cte_map (a, b) \<leadsto>\<^sup>+ x; x = 0; valid_pspace' s0H_internal\<rbrakk> \<Longrightarrow> False
 2. \<And>a b x. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal; map_to_ctes kh0H \<turnstile> cte_map (a, b) parentOf x; map_to_ctes kh0H \<turnstile> cte_map (a, b) \<leadsto>\<^sup>+ x; x = 0\<rbrakk> \<Longrightarrow> 1 \<le> maxDomain
 3. \<And>a b x. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal; map_to_ctes kh0H \<turnstile> cte_map (a, b) parentOf x; map_to_ctes kh0H \<turnstile> cte_map (a, b) \<leadsto>\<^sup>+ x; x \<noteq> 0\<rbrakk> \<Longrightarrow> False
 4. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a b x. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal; map_to_ctes kh0H \<turnstile> cte_map (a, b) parentOf x; map_to_ctes kh0H \<turnstile> cte_map (a, b) \<leadsto>\<^sup>+ x; x = 0\<rbrakk> \<Longrightarrow> 1 \<le> maxDomain
 2. \<And>a b x. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal; map_to_ctes kh0H \<turnstile> cte_map (a, b) parentOf x; map_to_ctes kh0H \<turnstile> cte_map (a, b) \<leadsto>\<^sup>+ x; x \<noteq> 0\<rbrakk> \<Longrightarrow> False
 3. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b x. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal; map_to_ctes kh0H \<turnstile> cte_map (a, b) parentOf x; map_to_ctes kh0H \<turnstile> cte_map (a, b) \<leadsto>\<^sup>+ x; x \<noteq> 0\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 5. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b x. \<lbrakk>1 \<le> maxDomain; cte_wp_at (\<lambda>_. True) (a, b) s0_internal; map_to_ctes kh0H \<turnstile> cte_map (a, b) parentOf x; cte_map (a, b) = Low_cnode_ptr + 0x13E0 \<and> x = Silc_cnode_ptr + 0x13E0 \<or> cte_map (a, b) = Silc_cnode_ptr + 0x13E0 \<and> x = High_cnode_ptr + 0x13E0 \<or> cte_map (a, b) = Low_cnode_ptr + 0x13E0 \<and> x = High_cnode_ptr + 0x13E0 \<or> cte_map (a, b) = Low_tcb_ptr \<and> x = Low_cnode_ptr + 0x20 \<or> cte_map (a, b) = Low_tcb_ptr + 0x10 \<and> x = Low_cnode_ptr + 0x30 \<or> cte_map (a, b) = High_tcb_ptr \<and> x = High_cnode_ptr + 0x20 \<or> cte_map (a, b) = High_tcb_ptr + 0x10 \<and> x = High_cnode_ptr + 0x30; x \<noteq> 0\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 5. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> cdt_list_relation (cdt_list s0_internal) (cdt s0_internal) (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 4. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 6. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_list s0_internal = ksDomSchedule s0H_internal
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b cap node aa ba. \<lbrakk>1 \<le> maxDomain; next_slot (a, b) (const []) (\<lambda>x. None) = Some (aa, ba); map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (aa, ba)
 2. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 4. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 6. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_list s0_internal = ksDomSchedule s0H_internal
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b cap node aa ba. \<lbrakk>1 \<le> maxDomain; next_not_child (a, b) (const []) (\<lambda>x. None) = Some (aa, ba); map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (aa, ba)
 2. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 4. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 6. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_list s0_internal = ksDomSchedule s0H_internal
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b cap node aa ba. \<lbrakk>1 \<le> maxDomain; next_not_child (a, b) (const []) (\<lambda>x. None) = Some (aa, ba); map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> \<forall>q. (a, b) \<in> descendants_of q (\<lambda>x. None) \<longrightarrow> next_sib q (const []) (\<lambda>x. None) = None
 2. \<And>a b cap node aa ba. \<lbrakk>1 \<le> maxDomain; next_not_child (a, b) (const []) (\<lambda>x. None) = Some (aa, ba); map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> next_sib (a, b) (const []) (\<lambda>x. None) = None
 3. \<And>a b cap node aa ba. \<lbrakk>1 \<le> maxDomain; next_not_child (a, b) (const []) (\<lambda>x. None) = Some (aa, ba); map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> finite_depth (\<lambda>x. None)
 4. \<And>a b cap node aa ba. \<lbrakk>1 \<le> maxDomain; next_not_child (a, b) (const []) (\<lambda>x. None) = Some (aa, ba); map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); next_not_child (a, b) (const []) (\<lambda>x. None) = None\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (aa, ba)
 5. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a b cap node aa ba. \<lbrakk>1 \<le> maxDomain; next_not_child (a, b) (const []) (\<lambda>x. None) = Some (aa, ba); map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> next_sib (a, b) (const []) (\<lambda>x. None) = None
 2. \<And>a b cap node aa ba. \<lbrakk>1 \<le> maxDomain; next_not_child (a, b) (const []) (\<lambda>x. None) = Some (aa, ba); map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> finite_depth (\<lambda>x. None)
 3. \<And>a b cap node aa ba. \<lbrakk>1 \<le> maxDomain; next_not_child (a, b) (const []) (\<lambda>x. None) = Some (aa, ba); map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); next_not_child (a, b) (const []) (\<lambda>x. None) = None\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (aa, ba)
 4. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 6. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b cap node aa ba. \<lbrakk>1 \<le> maxDomain; next_not_child (a, b) (const []) (\<lambda>x. None) = Some (aa, ba); map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> finite_depth (\<lambda>x. None)
 2. \<And>a b cap node aa ba. \<lbrakk>1 \<le> maxDomain; next_not_child (a, b) (const []) (\<lambda>x. None) = Some (aa, ba); map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); next_not_child (a, b) (const []) (\<lambda>x. None) = None\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (aa, ba)
 3. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 5. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b cap node aa ba. \<lbrakk>1 \<le> maxDomain; next_not_child (a, b) (const []) (\<lambda>x. None) = Some (aa, ba); map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); next_not_child (a, b) (const []) (\<lambda>x. None) = None\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (aa, ba)
 2. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 4. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 6. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_list s0_internal = ksDomSchedule s0H_internal
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> revokable_relation (is_original_cap s0_internal) (null_filter (caps_of_state s0_internal)) (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 3. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 5. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 6. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> domain_list s0_internal = ksDomSchedule s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> cur_domain s0_internal = ksCurDomain s0H_internal
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b y cap node. \<lbrakk>1 \<le> maxDomain; null_filter (caps_of_state s0_internal) (a, b) = Some y; map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 2. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 3. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 5. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 6. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> domain_list s0_internal = ksDomSchedule s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> cur_domain s0_internal = ksCurDomain s0H_internal
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; caps_of_state s0_internal (a, b) = Some y\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 2. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 3. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 5. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 6. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> domain_list s0_internal = ksDomSchedule s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> cur_domain s0_internal = ksCurDomain s0H_internal
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; y = cap.NullCap \<or> ((a, b), y) \<in> {((Low_cnode_ptr, the_nat_to_bl 10 1), cap.ThreadCap Low_tcb_ptr), ((Low_cnode_ptr, the_nat_to_bl 10 2), cap.CNodeCap Low_cnode_ptr 10 (the_nat_to_bl 10 2)), ((Low_cnode_ptr, the_nat_to_bl 10 3), cap.ArchObjectCap (arch_cap.PageDirectoryCap Low_pd_ptr (Some Low_asid))), ((Low_cnode_ptr, the_nat_to_bl 10 318), cap.NotificationCap ntfn_ptr 0 {AllowSend}), ((High_cnode_ptr, the_nat_to_bl 10 1), cap.ThreadCap High_tcb_ptr), ((High_cnode_ptr, the_nat_to_bl 10 2), cap.CNodeCap High_cnode_ptr 10 (the_nat_to_bl 10 2)), ((High_cnode_ptr, the_nat_to_bl 10 3), cap.ArchObjectCap (arch_cap.PageDirectoryCap High_pd_ptr (Some High_asid))), ((High_cnode_ptr, the_nat_to_bl 10 318), cap.NotificationCap ntfn_ptr 0 {AllowRecv}), ((Silc_cnode_ptr, the_nat_to_bl 10 2), cap.CNodeCap Silc_cnode_ptr 10 (the_nat_to_bl 10 2)), ((Silc_cnode_ptr, the_nat_to_bl 10 318), cap.NotificationCap ntfn_ptr 0 {AllowSend}), ((Low_tcb_ptr, tcb_cnode_index 0), cap.CNodeCap Low_cnode_ptr 10 (the_nat_to_bl 10 2)), ((Low_tcb_ptr, tcb_cnode_index 1), cap.ArchObjectCap (arch_cap.PageDirectoryCap Low_pd_ptr (Some Low_asid))), ((Low_tcb_ptr, tcb_cnode_index 2), cap.ReplyCap Low_tcb_ptr True {AllowGrant, AllowWrite}), ((Low_tcb_ptr, tcb_cnode_index 3), cap.NullCap), ((Low_tcb_ptr, tcb_cnode_index 4), cap.NullCap), ((High_tcb_ptr, tcb_cnode_index 0), cap.CNodeCap High_cnode_ptr 10 (the_nat_to_bl 10 2)), ((High_tcb_ptr, tcb_cnode_index 1), cap.ArchObjectCap (arch_cap.PageDirectoryCap High_pd_ptr (Some High_asid))), ((High_tcb_ptr, tcb_cnode_index 2), cap.ReplyCap High_tcb_ptr True {AllowGrant, AllowWrite}), ((High_tcb_ptr, tcb_cnode_index 3), cap.NullCap), ((High_tcb_ptr, tcb_cnode_index 4), cap.NullCap)}\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 2. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 3. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 5. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 6. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> domain_list s0_internal = ksDomSchedule s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> cur_domain s0_internal = ksCurDomain s0H_internal
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = Low_cnode_ptr \<and> b = the_nat_to_bl 10 (Suc 0) \<and> y = cap.ThreadCap Low_tcb_ptr \<or> a = Low_cnode_ptr \<and> b = the_nat_to_bl 10 2 \<and> y = cap.CNodeCap Low_cnode_ptr 10 (the_nat_to_bl 10 2) \<or> a = Low_cnode_ptr \<and> b = the_nat_to_bl 10 3 \<and> y = cap.ArchObjectCap (arch_cap.PageDirectoryCap Low_pd_ptr (Some Low_asid)) \<or> a = Low_cnode_ptr \<and> b = the_nat_to_bl 10 318 \<and> y = cap.NotificationCap ntfn_ptr 0 {AllowWrite} \<or> a = High_cnode_ptr \<and> b = the_nat_to_bl 10 (Suc 0) \<and> y = cap.ThreadCap High_tcb_ptr \<or> a = High_cnode_ptr \<and> b = the_nat_to_bl 10 2 \<and> y = cap.CNodeCap High_cnode_ptr 10 (the_nat_to_bl 10 2) \<or> a = High_cnode_ptr \<and> b = the_nat_to_bl 10 3 \<and> y = cap.ArchObjectCap (arch_cap.PageDirectoryCap High_pd_ptr (Some High_asid)) \<or> a = High_cnode_ptr \<and> b = the_nat_to_bl 10 318 \<and> y = cap.NotificationCap ntfn_ptr 0 {AllowRead} \<or> a = Silc_cnode_ptr \<and> b = the_nat_to_bl 10 2 \<and> y = cap.CNodeCap Silc_cnode_ptr 10 (the_nat_to_bl 10 2) \<or> a = Silc_cnode_ptr \<and> b = the_nat_to_bl 10 318 \<and> y = cap.NotificationCap ntfn_ptr 0 {AllowWrite} \<or> a = Low_tcb_ptr \<and> b = tcb_cnode_index 0 \<and> y = cap.CNodeCap Low_cnode_ptr 10 (the_nat_to_bl 10 2) \<or> a = Low_tcb_ptr \<and> b = tcb_cnode_index (Suc 0) \<and> y = cap.ArchObjectCap (arch_cap.PageDirectoryCap Low_pd_ptr (Some Low_asid)) \<or> a = Low_tcb_ptr \<and> b = tcb_cnode_index 2 \<and> y = cap.ReplyCap Low_tcb_ptr True {AllowGrant, AllowWrite} \<or> a = High_tcb_ptr \<and> b = tcb_cnode_index 0 \<and> y = cap.CNodeCap High_cnode_ptr 10 (the_nat_to_bl 10 2) \<or> a = High_tcb_ptr \<and> b = tcb_cnode_index (Suc 0) \<and> y = cap.ArchObjectCap (arch_cap.PageDirectoryCap High_pd_ptr (Some High_asid)) \<or> a = High_tcb_ptr \<and> b = tcb_cnode_index 2 \<and> y = cap.ReplyCap High_tcb_ptr True {AllowGrant, AllowWrite}\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 2. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 3. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 5. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 6. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> domain_list s0_internal = ksDomSchedule s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> cur_domain s0_internal = ksCurDomain s0H_internal
A total of 11 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = Low_cnode_ptr \<and> b = the_nat_to_bl 10 (Suc 0) \<and> y = cap.ThreadCap Low_tcb_ptr\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 2. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = Low_cnode_ptr \<and> b = the_nat_to_bl 10 2 \<and> y = cap.CNodeCap Low_cnode_ptr 10 (the_nat_to_bl 10 2)\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 3. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = Low_cnode_ptr \<and> b = the_nat_to_bl 10 3 \<and> y = cap.ArchObjectCap (arch_cap.PageDirectoryCap Low_pd_ptr (Some Low_asid))\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 4. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = Low_cnode_ptr \<and> b = the_nat_to_bl 10 318 \<and> y = cap.NotificationCap ntfn_ptr 0 {AllowWrite}\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 5. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = High_cnode_ptr \<and> b = the_nat_to_bl 10 (Suc 0) \<and> y = cap.ThreadCap High_tcb_ptr\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 6. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = High_cnode_ptr \<and> b = the_nat_to_bl 10 2 \<and> y = cap.CNodeCap High_cnode_ptr 10 (the_nat_to_bl 10 2)\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 7. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = High_cnode_ptr \<and> b = the_nat_to_bl 10 3 \<and> y = cap.ArchObjectCap (arch_cap.PageDirectoryCap High_pd_ptr (Some High_asid))\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 8. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = High_cnode_ptr \<and> b = the_nat_to_bl 10 318 \<and> y = cap.NotificationCap ntfn_ptr 0 {AllowRead}\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 9. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = Silc_cnode_ptr \<and> b = the_nat_to_bl 10 2 \<and> y = cap.CNodeCap Silc_cnode_ptr 10 (the_nat_to_bl 10 2)\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 10. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = Silc_cnode_ptr \<and> b = the_nat_to_bl 10 318 \<and> y = cap.NotificationCap ntfn_ptr 0 {AllowWrite}\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
A total of 26 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>cap node. \<lbrakk>map_to_ctes kh0H (Low_tcb_ptr + of_bl (tcb_cnode_index 0) * 0x10) = Some (CTE cap node); 1 \<le> maxDomain; mdbRevocable node\<rbrakk> \<Longrightarrow> False
 2. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = Low_tcb_ptr \<and> b = tcb_cnode_index (Suc 0) \<and> y = cap.ArchObjectCap (arch_cap.PageDirectoryCap Low_pd_ptr (Some Low_asid))\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 3. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = Low_tcb_ptr \<and> b = tcb_cnode_index 2 \<and> y = cap.ReplyCap Low_tcb_ptr True {AllowGrant, AllowWrite}\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 4. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = High_tcb_ptr \<and> b = tcb_cnode_index 0 \<and> y = cap.CNodeCap High_cnode_ptr 10 (the_nat_to_bl 10 2)\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 5. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = High_tcb_ptr \<and> b = tcb_cnode_index (Suc 0) \<and> y = cap.ArchObjectCap (arch_cap.PageDirectoryCap High_pd_ptr (Some High_asid))\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 6. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = High_tcb_ptr \<and> b = tcb_cnode_index 2 \<and> y = cap.ReplyCap High_tcb_ptr True {AllowGrant, AllowWrite}\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 7. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 8. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = Low_tcb_ptr \<and> b = tcb_cnode_index (Suc 0) \<and> y = cap.ArchObjectCap (arch_cap.PageDirectoryCap Low_pd_ptr (Some Low_asid))\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 2. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = Low_tcb_ptr \<and> b = tcb_cnode_index 2 \<and> y = cap.ReplyCap Low_tcb_ptr True {AllowGrant, AllowWrite}\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 3. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = High_tcb_ptr \<and> b = tcb_cnode_index 0 \<and> y = cap.CNodeCap High_cnode_ptr 10 (the_nat_to_bl 10 2)\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 4. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = High_tcb_ptr \<and> b = tcb_cnode_index (Suc 0) \<and> y = cap.ArchObjectCap (arch_cap.PageDirectoryCap High_pd_ptr (Some High_asid))\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 5. \<And>a b y cap node. \<lbrakk>map_to_ctes kh0H (cte_map (a, b)) = Some (CTE cap node); 1 \<le> maxDomain; y \<noteq> cap.NullCap; a = High_tcb_ptr \<and> b = tcb_cnode_index 2 \<and> y = cap.ReplyCap High_tcb_ptr True {AllowGrant, AllowWrite}\<rbrakk> \<Longrightarrow> is_original_cap s0_internal (a, b) = mdbRevocable node
 6. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 7. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
A total of 15 subgoals... proof (prove)
goal (10 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> (arch_state s0_internal, ksArchState s0H_internal) \<in> arch_state_relation
 2. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 3. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 4. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 5. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 6. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> domain_list s0_internal = ksDomSchedule s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> cur_domain s0_internal = ksCurDomain s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> domain_time s0_internal = ksDomainTime s0H_internal proof (prove)
goal (9 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> interrupt_state_relation (interrupt_irq_node s0_internal) (interrupt_states s0_internal) (ksInterruptState s0H_internal)
 2. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 4. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 5. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 6. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> domain_list s0_internal = ksDomSchedule s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> cur_domain s0_internal = ksCurDomain s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> domain_time s0_internal = ksDomainTime s0H_internal proof (prove)
goal (8 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> cur_thread s0_internal = ksCurThread s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> idle_thread s0_internal = ksIdleThread s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> machine_state s0_internal = ksMachineState s0H_internal
 4. 1 \<le> maxDomain \<Longrightarrow> work_units_completed s0_internal = ksWorkUnitsCompleted s0H_internal
 5. 1 \<le> maxDomain \<Longrightarrow> domain_index s0_internal = ksDomScheduleIdx s0H_internal
 6. 1 \<le> maxDomain \<Longrightarrow> domain_list s0_internal = ksDomSchedule s0H_internal
 7. 1 \<le> maxDomain \<Longrightarrow> cur_domain s0_internal = ksCurDomain s0H_internal
 8. 1 \<le> maxDomain \<Longrightarrow> domain_time s0_internal = ksDomainTime s0H_internal proof (prove)
goal:
No subgoals!