theory CNode_AC

lemma cap_swap_pas_refined[wp]:
  "\<lbrace>pas_refined aag and invs and cte_wp_at (weak_derived cap) slot
                    and cte_wp_at (weak_derived cap') slot'
                    and K (is_subject aag (fst slot) \<and> is_subject aag (fst slot') \<and>
                           pas_cap_cur_auth aag cap \<and> pas_cap_cur_auth aag cap')\<rbrace>
   cap_swap cap slot cap' slot'
   \<lbrace>\<lambda>_. pas_refined aag\<rbrace>" apply (simp add: cap_swap_def) apply (rule hoare_pre) apply (wp add: tcb_domain_map_wellformed_lift | simp split del: if_split)+ apply (simp only:pas_refined_def state_objs_to_policy_def) apply (wps | wp set_cap_state_vrefs set_cdt_cdt_ct_ms_rvk set_cap_caps_of_state)+ apply (clarsimp simp: pas_refined_def aag_cap_auth_def state_objs_to_policy_def
                        cte_wp_at_caps_of_state
                 split: if_split_asm split del: if_split) apply (rename_tac old_cap old_cap') apply (intro conjI) apply (find_goal \<open>match conclusion in "state_asids_to_policy_arch _ _ _ _ \<subseteq> _" \<Rightarrow> succeed\<close>) apply (erule sata_update2[unfolded fun_upd_def]; fastforce) apply (find_goal \<open>match conclusion in "state_irqs_to_policy_aux _ _ \<subseteq> _" \<Rightarrow> succeed\<close>) apply (erule sita_caps_update2[unfolded fun_upd_def]; fastforce) apply (find_goal \<open>match conclusion in "auth_graph_map _ _ \<subseteq> _" \<Rightarrow> succeed\<close>) apply (rule subsetI) apply clarsimp apply (erule auth_graph_map_memE) apply (simp only: eq_commute[where b=slot'] eq_commute[where b=slot]) apply (erule state_bits_to_policy.cases) apply (simp split: if_splits, blast intro: sbta_caps auth_graph_map_memI) apply (simp split: if_splits, blast intro: state_bits_to_policy.intros auth_graph_map_memI) apply (blast intro: state_bits_to_policy.intros auth_graph_map_memI) apply (blast intro: state_bits_to_policy.intros auth_graph_map_memI) apply clarsimp subgoal for s old_cap old_cap' child_obj child_index parent_obj parent_index apply (simp split: if_splits add: aag_wellformed_refl) by (erule subsetD;
          force simp: is_transferable_weak_derived intro!: sbta_cdt auth_graph_map_memI)+ apply clarsimp subgoal for s old_cap old_cap' child_obj child_index parent_obj parent_index apply (simp split: if_splits add: aag_wellformed_refl) by (erule subsetD;
         force simp: is_transferable_weak_derived intro!: sbta_cdt_transferable auth_graph_map_memI)+ apply (blast intro: state_bits_to_policy.intros auth_graph_map_memI) by fastforce+

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>pas_refined aag and invs and cte_wp_at (weak_derived cap) slot and cte_wp_at (weak_derived cap') slot' and K (is_subject aag (fst slot) \<and> is_subject aag (fst slot') \<and> pas_cap_cur_auth aag cap \<and> pas_cap_cur_auth aag cap')\<rbrace> cap_swap cap slot cap' slot' \<lbrace>\<lambda>_. pas_refined aag\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>pas_refined aag and invs and cte_wp_at (weak_derived cap) slot and cte_wp_at (weak_derived cap') slot' and (\<lambda>y. is_subject aag (fst slot) \<and> is_subject aag (fst slot') \<and> pas_cap_cur_auth aag cap \<and> pas_cap_cur_auth aag cap')\<rbrace> do y <- set_cap cap' slot;
y <- set_cap cap slot';
slot1_p <- gets (\<lambda>s. cdt s slot);
slot2_p <- gets (\<lambda>s. cdt s slot');
cdt <- gets cdt;
y <- set_cdt ((\<lambda>n. if cdt n = Some slot then Some slot' else if cdt n = Some slot' then Some slot else cdt n)(slot := if cdt slot' = Some slot then Some slot' else if cdt slot' = Some slot' then Some slot else cdt slot', slot' := if cdt slot = Some slot then Some slot' else if cdt slot = Some slot' then Some slot else cdt slot));
y <- cap_swap_ext slot slot' slot1_p slot2_p;
is_original <- gets is_original_cap;
y <- set_original slot (is_original slot');
set_original slot' (is_original slot)
od \<lbrace>\<lambda>_. pas_refined aag\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q\<rbrace> do y <- set_cap cap' slot;
y <- set_cap cap slot';
slot1_p <- gets (\<lambda>s. cdt s slot);
slot2_p <- gets (\<lambda>s. cdt s slot');
cdt <- gets cdt;
y <- set_cdt ((\<lambda>n. if cdt n = Some slot then Some slot' else if cdt n = Some slot' then Some slot else cdt n)(slot := if cdt slot' = Some slot then Some slot' else if cdt slot' = Some slot' then Some slot else cdt slot', slot' := if cdt slot = Some slot then Some slot' else if cdt slot = Some slot' then Some slot else cdt slot));
y <- cap_swap_ext slot slot' slot1_p slot2_p;
is_original <- gets is_original_cap;
y <- set_original slot (is_original slot');
set_original slot' (is_original slot)
od \<lbrace>\<lambda>_. pas_refined aag\<rbrace>
 2. \<And>s. (pas_refined aag and invs and cte_wp_at (weak_derived cap) slot and cte_wp_at (weak_derived cap') slot' and (\<lambda>y. is_subject aag (fst slot) \<and> is_subject aag (fst slot') \<and> pas_cap_cur_auth aag cap \<and> pas_cap_cur_auth aag cap')) s \<Longrightarrow> ?Q s proof (prove)
goal (7 subgoals):
 1. \<And>slot1_p slot2_p cdt. \<lbrace>?B8 () () slot1_p slot2_p cdt\<rbrace> set_cdt ((\<lambda>n. if cdt n = Some slot then Some slot' else if cdt n = Some slot' then Some slot else cdt n)(slot := if cdt slot' = Some slot then Some slot' else if cdt slot' = Some slot' then Some slot else cdt slot', slot' := if cdt slot = Some slot then Some slot' else if cdt slot = Some slot' then Some slot else cdt slot)) \<lbrace>\<lambda>yb. pas_refined aag\<rbrace>
 2. \<And>y ya slot1_p slot2_p. \<lbrace>?B7 y ya slot1_p slot2_p\<rbrace> gets cdt \<lbrace>?B8 y ya slot1_p slot2_p\<rbrace>
 3. \<And>y ya slot1_p. \<lbrace>?B6 y ya slot1_p\<rbrace> gets (\<lambda>s. cdt s slot') \<lbrace>?B7 y ya slot1_p\<rbrace>
 4. \<And>y ya. \<lbrace>?B5 y ya\<rbrace> gets (\<lambda>s. cdt s slot) \<lbrace>?B6 y ya\<rbrace>
 5. \<And>y. \<lbrace>?B4 y\<rbrace> set_cap cap slot' \<lbrace>?B5 y\<rbrace>
 6. \<lbrace>?Q\<rbrace> set_cap cap' slot \<lbrace>?B4\<rbrace>
 7. \<And>s. (pas_refined aag and invs and cte_wp_at (weak_derived cap) slot and cte_wp_at (weak_derived cap') slot' and (\<lambda>y. is_subject aag (fst slot) \<and> is_subject aag (fst slot') \<and> pas_cap_cur_auth aag cap \<and> pas_cap_cur_auth aag cap')) s \<Longrightarrow> ?Q s proof (prove)
goal (7 subgoals):
 1. \<And>slot1_p slot2_p cdta. \<lbrace>?B8 () () slot1_p slot2_p cdta\<rbrace> set_cdt ((\<lambda>n. if cdta n = Some slot then Some slot' else if cdta n = Some slot' then Some slot else cdta n)(slot := if cdta slot' = Some slot then Some slot' else if cdta slot' = Some slot' then Some slot else cdta slot', slot' := if cdta slot = Some slot then Some slot' else if cdta slot = Some slot' then Some slot else cdta slot)) \<lbrace>\<lambda>yb s. pas_wellformed aag \<and> irq_map_wellformed aag s \<and> tcb_domain_map_wellformed aag s \<and> auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag \<and> state_asids_to_policy aag s \<subseteq> pasPolicy aag \<and> state_irqs_to_policy aag s \<subseteq> pasPolicy aag\<rbrace>
 2. \<And>y ya slot1_p slot2_p. \<lbrace>?B7 y ya slot1_p slot2_p\<rbrace> gets cdt \<lbrace>?B8 y ya slot1_p slot2_p\<rbrace>
 3. \<And>y ya slot1_p. \<lbrace>?B6 y ya slot1_p\<rbrace> gets (\<lambda>s. cdt s slot') \<lbrace>?B7 y ya slot1_p\<rbrace>
 4. \<And>y ya. \<lbrace>?B5 y ya\<rbrace> gets (\<lambda>s. cdt s slot) \<lbrace>?B6 y ya\<rbrace>
 5. \<And>y. \<lbrace>?B4 y\<rbrace> set_cap cap slot' \<lbrace>?B5 y\<rbrace>
 6. \<lbrace>?Q\<rbrace> set_cap cap' slot \<lbrace>?B4\<rbrace>
 7. \<And>s. (pas_refined aag and invs and cte_wp_at (weak_derived cap) slot and cte_wp_at (weak_derived cap') slot' and (\<lambda>y. is_subject aag (fst slot) \<and> is_subject aag (fst slot') \<and> pas_cap_cur_auth aag cap \<and> pas_cap_cur_auth aag cap')) s \<Longrightarrow> ?Q s proof (prove)
goal (1 subgoal):
 1. \<And>s. (pas_refined aag and invs and cte_wp_at (weak_derived cap) slot and cte_wp_at (weak_derived cap') slot' and (\<lambda>y. is_subject aag (fst slot) \<and> is_subject aag (fst slot') \<and> pas_cap_cur_auth aag cap \<and> pas_cap_cur_auth aag cap')) s \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> (pspace_aligned and valid_vspace_objs and valid_arch_state and (\<lambda>sa. pas_wellformed aag \<and> irq_map_wellformed aag s \<and> tcb_domain_map_wellformed aag s \<and> auth_graph_map (pasObjectAbs aag) (state_bits_to_policy ((caps_of_state s)(slot \<mapsto> cap', slot' \<mapsto> cap)) (thread_st_auth s) (thread_bound_ntfns s) ((\<lambda>n. if cdt s n = Some slot then Some slot' else if cdt s n = Some slot' then Some slot else cdt s n)(slot := if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot', slot' := if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot)) (state_vrefs sa)) \<subseteq> pasPolicy aag \<and> state_asids_to_policy_arch aag ((caps_of_state s)(slot \<mapsto> cap', slot' \<mapsto> cap)) (arch_state s) (state_vrefs sa) \<subseteq> pasPolicy aag \<and> state_irqs_to_policy_aux aag ((caps_of_state s)(slot \<mapsto> cap', slot' \<mapsto> cap)) \<subseteq> pasPolicy aag)) s proof (prove)
goal (1 subgoal):
 1. \<And>s capa capaa. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some capa; weak_derived cap capa; is_subject aag (fst slot); caps_of_state s slot' = Some capaa; weak_derived cap' capaa; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (thread_st_auth s) (thread_bound_ntfns s) (\<lambda>a. if a = slot' then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if a = slot then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s a = Some slot then Some slot' else if cdt s a = Some slot' then Some slot else cdt s a) (state_vrefs s)) \<subseteq> pasPolicy aag \<and> state_asids_to_policy_arch aag (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (arch_state s) (state_vrefs s) \<subseteq> pasPolicy aag \<and> state_irqs_to_policy_aux aag (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) \<subseteq> pasPolicy aag proof (prove)
goal (1 subgoal):
 1. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (thread_st_auth s) (thread_bound_ntfns s) (\<lambda>a. if a = slot' then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if a = slot then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s a = Some slot then Some slot' else if cdt s a = Some slot' then Some slot else cdt s a) (state_vrefs s)) \<subseteq> pasPolicy aag \<and> state_asids_to_policy_arch aag (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (arch_state s) (state_vrefs s) \<subseteq> pasPolicy aag \<and> state_irqs_to_policy_aux aag (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) \<subseteq> pasPolicy aag proof (prove)
goal (9 subgoals):
 1. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 2. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (thread_st_auth s) (thread_bound_ntfns s) (\<lambda>a. if a = slot' then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if a = slot then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s a = Some slot then Some slot' else if cdt s a = Some slot' then Some slot else cdt s a) (state_vrefs s)) \<subseteq> pasPolicy aag
 8. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> state_asids_to_policy_arch aag (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (arch_state s) (state_vrefs s) \<subseteq> pasPolicy aag
 9. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> state_irqs_to_policy_aux aag (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) \<subseteq> pasPolicy aag proof (prove)
goal (9 subgoals):
 1. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> state_asids_to_policy_arch aag (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (arch_state s) (state_vrefs s) \<subseteq> pasPolicy aag
 2. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 8. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (thread_st_auth s) (thread_bound_ntfns s) (\<lambda>a. if a = slot' then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if a = slot then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s a = Some slot then Some slot' else if cdt s a = Some slot' then Some slot else cdt s a) (state_vrefs s)) \<subseteq> pasPolicy aag
 9. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> state_irqs_to_policy_aux aag (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) \<subseteq> pasPolicy aag proof (prove)
goal (8 subgoals):
 1. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 2. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (thread_st_auth s) (thread_bound_ntfns s) (\<lambda>a. if a = slot' then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if a = slot then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s a = Some slot then Some slot' else if cdt s a = Some slot' then Some slot else cdt s a) (state_vrefs s)) \<subseteq> pasPolicy aag
 8. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> state_irqs_to_policy_aux aag (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) \<subseteq> pasPolicy aag proof (prove)
goal (8 subgoals):
 1. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> state_irqs_to_policy_aux aag (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) \<subseteq> pasPolicy aag
 2. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 8. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (thread_st_auth s) (thread_bound_ntfns s) (\<lambda>a. if a = slot' then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if a = slot then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s a = Some slot then Some slot' else if cdt s a = Some slot' then Some slot else cdt s a) (state_vrefs s)) \<subseteq> pasPolicy aag proof (prove)
goal (7 subgoals):
 1. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 2. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (thread_st_auth s) (thread_bound_ntfns s) (\<lambda>a. if a = slot' then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if a = slot then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s a = Some slot then Some slot' else if cdt s a = Some slot' then Some slot else cdt s a) (state_vrefs s)) \<subseteq> pasPolicy aag proof (prove)
goal (7 subgoals):
 1. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (thread_st_auth s) (thread_bound_ntfns s) (\<lambda>a. if a = slot' then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if a = slot then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s a = Some slot then Some slot' else if cdt s a = Some slot' then Some slot else cdt s a) (state_vrefs s)) \<subseteq> pasPolicy aag
 2. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s proof (prove)
goal (7 subgoals):
 1. \<And>s old_cap old_cap' x. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; x \<in> auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (thread_st_auth s) (thread_bound_ntfns s) (\<lambda>a. if a = slot' then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if a = slot then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s a = Some slot then Some slot' else if cdt s a = Some slot' then Some slot else cdt s a) (state_vrefs s))\<rbrakk> \<Longrightarrow> x \<in> pasPolicy aag
 2. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s proof (prove)
goal (7 subgoals):
 1. \<And>s old_cap old_cap' a aa b. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; (a, aa, b) \<in> auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (thread_st_auth s) (thread_bound_ntfns s) (\<lambda>a. if a = slot' then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if a = slot then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s a = Some slot then Some slot' else if cdt s a = Some slot' then Some slot else cdt s a) (state_vrefs s))\<rbrakk> \<Longrightarrow> (a, aa, b) \<in> pasPolicy aag
 2. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s proof (prove)
goal (7 subgoals):
 1. \<And>s old_cap old_cap' a aa b x' y'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; (x', aa, y') \<in> state_bits_to_policy (\<lambda>a. if a = slot' then Some cap else if a = slot then Some cap' else caps_of_state s a) (thread_st_auth s) (thread_bound_ntfns s) (\<lambda>a. if a = slot' then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if a = slot then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s a = Some slot then Some slot' else if cdt s a = Some slot' then Some slot else cdt s a) (state_vrefs s)\<rbrakk> \<Longrightarrow> (a, aa, b) \<in> pasPolicy aag
 2. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s proof (prove)
goal (7 subgoals):
 1. \<And>s old_cap old_cap' a aa b x' y'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; (x', aa, y') \<in> state_bits_to_policy (\<lambda>a. if slot' = a then Some cap else if slot = a then Some cap' else caps_of_state s a) (thread_st_auth s) (thread_bound_ntfns s) (\<lambda>a. if slot' = a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s a = Some slot then Some slot' else if cdt s a = Some slot' then Some slot else cdt s a) (state_vrefs s)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 2. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s proof (prove)
goal (13 subgoals):
 1. \<And>s old_cap old_cap' a aa b x' y' ptr capa oref auth. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst ptr; aa = auth; y' = oref; (if slot' = ptr then Some cap else if slot = ptr then Some cap' else caps_of_state s ptr) = Some capa; oref \<in> obj_refs_ac capa; auth \<in> cap_auth_conferred capa\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 2. \<And>s old_cap old_cap' a aa b x' y' ptr capa oref. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst ptr; aa = Control; y' = oref; (if slot' = ptr then Some cap else if slot = ptr then Some cap' else caps_of_state s ptr) = Some capa; oref \<in> untyped_range capa\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 3. \<And>s old_cap old_cap' a aa b x' y' oref' auth oref. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = oref; aa = auth; y' = oref'; (oref', auth) \<in> thread_st_auth s oref\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 4. \<And>s old_cap old_cap' a aa b x' y' oref oref' auth. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = oref; aa = auth; y' = oref'; thread_bound_ntfns s oref = Some oref'; auth \<in> {Receive, Reset}\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 5. \<And>s old_cap old_cap' a aa b x' y' slot'a slota. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst slota; aa = Control; y' = fst slot'a; (if slot' = slot'a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = slot'a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s slot'a = Some slot then Some slot' else if cdt s slot'a = Some slot' then Some slot else cdt s slot'a) = Some slota; \<not> is_transferable (if slot' = slot'a then Some cap else if slot = slot'a then Some cap' else caps_of_state s slot'a)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 6. \<And>s old_cap old_cap' a aa b x' y' slot'a slota. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst slota; aa = DeleteDerived; y' = fst slot'a; (if slot' = slot'a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = slot'a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s slot'a = Some slot then Some slot' else if cdt s slot'a = Some slot' then Some slot else cdt s slot'a) = Some slota\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 7. \<And>s old_cap old_cap' a aa b x' y' ptr' uu_ uv_ auth ptr. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = ptr; aa = auth; y' = ptr'; (ptr', uu_, uv_, auth) \<in> state_vrefs s ptr\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 8. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 9. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 10. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s old_cap old_cap' a aa b x' y' ptr capa oref. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst ptr; aa = Control; y' = oref; (if slot' = ptr then Some cap else if slot = ptr then Some cap' else caps_of_state s ptr) = Some capa; oref \<in> untyped_range capa\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 2. \<And>s old_cap old_cap' a aa b x' y' oref' auth oref. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = oref; aa = auth; y' = oref'; (oref', auth) \<in> thread_st_auth s oref\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 3. \<And>s old_cap old_cap' a aa b x' y' oref oref' auth. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = oref; aa = auth; y' = oref'; thread_bound_ntfns s oref = Some oref'; auth \<in> {Receive, Reset}\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 4. \<And>s old_cap old_cap' a aa b x' y' slot'a slota. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst slota; aa = Control; y' = fst slot'a; (if slot' = slot'a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = slot'a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s slot'a = Some slot then Some slot' else if cdt s slot'a = Some slot' then Some slot else cdt s slot'a) = Some slota; \<not> is_transferable (if slot' = slot'a then Some cap else if slot = slot'a then Some cap' else caps_of_state s slot'a)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 5. \<And>s old_cap old_cap' a aa b x' y' slot'a slota. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst slota; aa = DeleteDerived; y' = fst slot'a; (if slot' = slot'a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = slot'a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s slot'a = Some slot then Some slot' else if cdt s slot'a = Some slot' then Some slot else cdt s slot'a) = Some slota\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 6. \<And>s old_cap old_cap' a aa b x' y' ptr' uu_ uv_ auth ptr. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = ptr; aa = auth; y' = ptr'; (ptr', uu_, uv_, auth) \<in> state_vrefs s ptr\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 8. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 9. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 10. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s old_cap old_cap' a aa b x' y' oref' auth oref. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = oref; aa = auth; y' = oref'; (oref', auth) \<in> thread_st_auth s oref\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 2. \<And>s old_cap old_cap' a aa b x' y' oref oref' auth. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = oref; aa = auth; y' = oref'; thread_bound_ntfns s oref = Some oref'; auth \<in> {Receive, Reset}\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 3. \<And>s old_cap old_cap' a aa b x' y' slot'a slota. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst slota; aa = Control; y' = fst slot'a; (if slot' = slot'a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = slot'a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s slot'a = Some slot then Some slot' else if cdt s slot'a = Some slot' then Some slot else cdt s slot'a) = Some slota; \<not> is_transferable (if slot' = slot'a then Some cap else if slot = slot'a then Some cap' else caps_of_state s slot'a)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 4. \<And>s old_cap old_cap' a aa b x' y' slot'a slota. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst slota; aa = DeleteDerived; y' = fst slot'a; (if slot' = slot'a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = slot'a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s slot'a = Some slot then Some slot' else if cdt s slot'a = Some slot' then Some slot else cdt s slot'a) = Some slota\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 5. \<And>s old_cap old_cap' a aa b x' y' ptr' uu_ uv_ auth ptr. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = ptr; aa = auth; y' = ptr'; (ptr', uu_, uv_, auth) \<in> state_vrefs s ptr\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 8. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 9. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 10. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s old_cap old_cap' a aa b x' y' oref oref' auth. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = oref; aa = auth; y' = oref'; thread_bound_ntfns s oref = Some oref'; auth \<in> {Receive, Reset}\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 2. \<And>s old_cap old_cap' a aa b x' y' slot'a slota. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst slota; aa = Control; y' = fst slot'a; (if slot' = slot'a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = slot'a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s slot'a = Some slot then Some slot' else if cdt s slot'a = Some slot' then Some slot else cdt s slot'a) = Some slota; \<not> is_transferable (if slot' = slot'a then Some cap else if slot = slot'a then Some cap' else caps_of_state s slot'a)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 3. \<And>s old_cap old_cap' a aa b x' y' slot'a slota. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst slota; aa = DeleteDerived; y' = fst slot'a; (if slot' = slot'a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = slot'a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s slot'a = Some slot then Some slot' else if cdt s slot'a = Some slot' then Some slot else cdt s slot'a) = Some slota\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 4. \<And>s old_cap old_cap' a aa b x' y' ptr' uu_ uv_ auth ptr. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = ptr; aa = auth; y' = ptr'; (ptr', uu_, uv_, auth) \<in> state_vrefs s ptr\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 8. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 9. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 10. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s proof (prove)
goal (9 subgoals):
 1. \<And>s old_cap old_cap' a aa b x' y' slot'a slota. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst slota; aa = Control; y' = fst slot'a; (if slot' = slot'a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = slot'a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s slot'a = Some slot then Some slot' else if cdt s slot'a = Some slot' then Some slot else cdt s slot'a) = Some slota; \<not> is_transferable (if slot' = slot'a then Some cap else if slot = slot'a then Some cap' else caps_of_state s slot'a)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 2. \<And>s old_cap old_cap' a aa b x' y' slot'a slota. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst slota; aa = DeleteDerived; y' = fst slot'a; (if slot' = slot'a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = slot'a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s slot'a = Some slot then Some slot' else if cdt s slot'a = Some slot' then Some slot else cdt s slot'a) = Some slota\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 3. \<And>s old_cap old_cap' a aa b x' y' ptr' uu_ uv_ auth ptr. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = ptr; aa = auth; y' = ptr'; (ptr', uu_, uv_, auth) \<in> state_vrefs s ptr\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 8. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 9. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s proof (prove)
goal (9 subgoals):
 1. \<And>s old_cap old_cap' ab ba ac bb. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; (if slot' = (ab, ba) then if cdt s slot = Some slot then Some (ab, ba) else if cdt s slot = Some (ab, ba) then Some slot else cdt s slot else if slot = (ab, ba) then if cdt s slot' = Some (ab, ba) then Some slot' else if cdt s slot' = Some slot' then Some (ab, ba) else cdt s slot' else if cdt s (ab, ba) = Some slot then Some slot' else if cdt s (ab, ba) = Some slot' then Some slot else cdt s (ab, ba)) = Some (ac, bb); \<not> is_transferable (if slot' = (ab, ba) then Some cap else if slot = (ab, ba) then Some cap' else caps_of_state s (ab, ba))\<rbrakk> \<Longrightarrow> (pasObjectAbs aag ac, Control, pasObjectAbs aag ab) \<in> pasPolicy aag
 2. \<And>s old_cap old_cap' a aa b x' y' slot'a slota. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst slota; aa = DeleteDerived; y' = fst slot'a; (if slot' = slot'a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = slot'a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s slot'a = Some slot then Some slot' else if cdt s slot'a = Some slot' then Some slot else cdt s slot'a) = Some slota\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 3. \<And>s old_cap old_cap' a aa b x' y' ptr' uu_ uv_ auth ptr. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = ptr; aa = auth; y' = ptr'; (ptr', uu_, uv_, auth) \<in> state_vrefs s ptr\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 8. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 9. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; (if slot' = (child_obj, child_index) then if cdt s slot = Some slot then Some (child_obj, child_index) else if cdt s slot = Some (child_obj, child_index) then Some slot else cdt s slot else if slot = (child_obj, child_index) then if cdt s slot' = Some (child_obj, child_index) then Some slot' else if cdt s slot' = Some slot' then Some (child_obj, child_index) else cdt s slot' else if cdt s (child_obj, child_index) = Some slot then Some slot' else if cdt s (child_obj, child_index) = Some slot' then Some slot else cdt s (child_obj, child_index)) = Some (parent_obj, parent_index); \<not> is_transferable (if slot' = (child_obj, child_index) then Some cap else if slot = (child_obj, child_index) then Some cap' else caps_of_state s (child_obj, child_index))\<rbrakk> \<Longrightarrow> (pasObjectAbs aag parent_obj, Control, pasObjectAbs aag child_obj) \<in> pasPolicy aag proof (prove)
goal (5 subgoals):
 1. \<lbrakk>\<not> is_transferable_cap cap; pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s (child_obj, child_index) = Some old_cap'; weak_derived cap' old_cap'; is_subject aag child_obj; \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; slot' = (child_obj, child_index); (parent_obj, parent_index) \<noteq> slot; parent_obj = child_obj \<longrightarrow> parent_index \<noteq> child_index; cdt s slot = Some (parent_obj, parent_index)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag parent_obj, Control, pasSubject aag) \<in> pasPolicy aag
 2. \<lbrakk>slot = (child_obj, child_index); \<not> is_transferable_cap cap'; pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s (child_obj, child_index) = Some old_cap; weak_derived cap old_cap; is_subject aag child_obj; caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; slot' \<noteq> (child_obj, child_index); parent_obj = child_obj \<longrightarrow> parent_index \<noteq> child_index; (parent_obj, parent_index) \<noteq> slot'; cdt s slot' = Some (parent_obj, parent_index)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag parent_obj, Control, pasSubject aag) \<in> pasPolicy aag
 3. \<lbrakk>slot \<noteq> (child_obj, child_index); \<not> is_transferable_in (child_obj, child_index) s; pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s (parent_obj, parent_index) = Some old_cap'; weak_derived cap' old_cap'; is_subject aag parent_obj; \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; parent_obj = child_obj \<longrightarrow> parent_index \<noteq> child_index; cdt s (child_obj, child_index) = Some slot; slot' = (parent_obj, parent_index)\<rbrakk> \<Longrightarrow> (pasSubject aag, Control, pasObjectAbs aag child_obj) \<in> pasPolicy aag
 4. \<lbrakk>parent_obj = child_obj \<longrightarrow> parent_index \<noteq> child_index; \<not> is_transferable_in (child_obj, child_index) s; pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s (parent_obj, parent_index) = Some old_cap; weak_derived cap old_cap; is_subject aag parent_obj; caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; slot' \<noteq> (child_obj, child_index); slot' \<noteq> (parent_obj, parent_index); cdt s (child_obj, child_index) = Some slot'; slot = (parent_obj, parent_index)\<rbrakk> \<Longrightarrow> (pasSubject aag, Control, pasObjectAbs aag child_obj) \<in> pasPolicy aag
 5. \<lbrakk>slot \<noteq> (child_obj, child_index); \<not> is_transferable_in (child_obj, child_index) s; pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; slot' \<noteq> (child_obj, child_index); (parent_obj, parent_index) \<noteq> slot; (parent_obj, parent_index) \<noteq> slot'; cdt s (child_obj, child_index) = Some (parent_obj, parent_index)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag parent_obj, Control, pasObjectAbs aag child_obj) \<in> pasPolicy aag proof (prove)
goal (8 subgoals):
 1. \<And>s old_cap old_cap' a aa b x' y' slot'a slota. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = fst slota; aa = DeleteDerived; y' = fst slot'a; (if slot' = slot'a then if cdt s slot = Some slot then Some slot' else if cdt s slot = Some slot' then Some slot else cdt s slot else if slot = slot'a then if cdt s slot' = Some slot then Some slot' else if cdt s slot' = Some slot' then Some slot else cdt s slot' else if cdt s slot'a = Some slot then Some slot' else if cdt s slot'a = Some slot' then Some slot else cdt s slot'a) = Some slota\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 2. \<And>s old_cap old_cap' a aa b x' y' ptr' uu_ uv_ auth ptr. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = ptr; aa = auth; y' = ptr'; (ptr', uu_, uv_, auth) \<in> state_vrefs s ptr\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 8. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s proof (prove)
goal (8 subgoals):
 1. \<And>s old_cap old_cap' ab ba ac bb. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; (if slot' = (ab, ba) then if cdt s slot = Some slot then Some (ab, ba) else if cdt s slot = Some (ab, ba) then Some slot else cdt s slot else if slot = (ab, ba) then if cdt s slot' = Some (ab, ba) then Some slot' else if cdt s slot' = Some slot' then Some (ab, ba) else cdt s slot' else if cdt s (ab, ba) = Some slot then Some slot' else if cdt s (ab, ba) = Some slot' then Some slot else cdt s (ab, ba)) = Some (ac, bb)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag ac, DeleteDerived, pasObjectAbs aag ab) \<in> pasPolicy aag
 2. \<And>s old_cap old_cap' a aa b x' y' ptr' uu_ uv_ auth ptr. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = ptr; aa = auth; y' = ptr'; (ptr', uu_, uv_, auth) \<in> state_vrefs s ptr\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 8. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; (if slot' = (child_obj, child_index) then if cdt s slot = Some slot then Some (child_obj, child_index) else if cdt s slot = Some (child_obj, child_index) then Some slot else cdt s slot else if slot = (child_obj, child_index) then if cdt s slot' = Some (child_obj, child_index) then Some slot' else if cdt s slot' = Some slot' then Some (child_obj, child_index) else cdt s slot' else if cdt s (child_obj, child_index) = Some slot then Some slot' else if cdt s (child_obj, child_index) = Some slot' then Some slot else cdt s (child_obj, child_index)) = Some (parent_obj, parent_index)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag parent_obj, DeleteDerived, pasObjectAbs aag child_obj) \<in> pasPolicy aag proof (prove)
goal (5 subgoals):
 1. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s (child_obj, child_index) = Some old_cap'; weak_derived cap' old_cap'; is_subject aag child_obj; \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; slot' = (child_obj, child_index); (parent_obj, parent_index) \<noteq> slot; parent_obj = child_obj \<longrightarrow> parent_index \<noteq> child_index; cdt s slot = Some (parent_obj, parent_index)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag parent_obj, DeleteDerived, pasSubject aag) \<in> pasPolicy aag
 2. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s (child_obj, child_index) = Some old_cap; weak_derived cap old_cap; is_subject aag child_obj; caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; slot' \<noteq> (child_obj, child_index); slot = (child_obj, child_index); parent_obj = child_obj \<longrightarrow> parent_index \<noteq> child_index; (parent_obj, parent_index) \<noteq> slot'; cdt s slot' = Some (parent_obj, parent_index)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag parent_obj, DeleteDerived, pasSubject aag) \<in> pasPolicy aag
 3. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s (parent_obj, parent_index) = Some old_cap'; weak_derived cap' old_cap'; is_subject aag parent_obj; \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; parent_obj = child_obj \<longrightarrow> parent_index \<noteq> child_index; slot \<noteq> (child_obj, child_index); cdt s (child_obj, child_index) = Some slot; slot' = (parent_obj, parent_index)\<rbrakk> \<Longrightarrow> (pasSubject aag, DeleteDerived, pasObjectAbs aag child_obj) \<in> pasPolicy aag
 4. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s (parent_obj, parent_index) = Some old_cap; weak_derived cap old_cap; is_subject aag parent_obj; caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; slot' \<noteq> (child_obj, child_index); parent_obj = child_obj \<longrightarrow> parent_index \<noteq> child_index; slot' \<noteq> (parent_obj, parent_index); cdt s (child_obj, child_index) = Some slot'; slot = (parent_obj, parent_index)\<rbrakk> \<Longrightarrow> (pasSubject aag, DeleteDerived, pasObjectAbs aag child_obj) \<in> pasPolicy aag
 5. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; slot' \<noteq> (child_obj, child_index); slot \<noteq> (child_obj, child_index); (parent_obj, parent_index) \<noteq> slot; (parent_obj, parent_index) \<noteq> slot'; cdt s (child_obj, child_index) = Some (parent_obj, parent_index)\<rbrakk> \<Longrightarrow> (pasObjectAbs aag parent_obj, DeleteDerived, pasObjectAbs aag child_obj) \<in> pasPolicy aag proof (prove)
goal (7 subgoals):
 1. \<And>s old_cap old_cap' a aa b x' y' ptr' uu_ uv_ auth ptr. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'; a = pasObjectAbs aag x'; b = pasObjectAbs aag y'; x' = ptr; aa = auth; y' = ptr'; (ptr', uu_, uv_, auth) \<in> state_vrefs s ptr\<rbrakk> \<Longrightarrow> (pasObjectAbs aag x', aa, pasObjectAbs aag y') \<in> pasPolicy aag
 2. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 7. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s proof (prove)
goal (6 subgoals):
 1. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 2. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s
 4. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> pspace_aligned s
 5. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 6. \<And>s old_cap old_cap'. \<lbrakk>pas_wellformed aag; irq_map_wellformed aag s; tcb_domain_map_wellformed aag s; auth_graph_map (pasObjectAbs aag) (state_bits_to_policy (caps_of_state s) (thread_st_auth s) (thread_bound_ntfns s) (cdt s) (state_vrefs s)) \<subseteq> pasPolicy aag; state_asids_to_policy aag s \<subseteq> pasPolicy aag; state_irqs_to_policy aag s \<subseteq> pasPolicy aag; invs s; caps_of_state s slot = Some old_cap; weak_derived cap old_cap; is_subject aag (fst slot); caps_of_state s slot' = Some old_cap'; weak_derived cap' old_cap'; is_subject aag (fst slot'); \<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap; cap_links_irq aag (pasSubject aag) cap; \<forall>x\<in>obj_refs_ac cap'. \<forall>auth\<in>cap_auth_conferred cap'. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range cap'. (pasSubject aag, Control, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) cap'; cap_links_irq aag (pasSubject aag) cap'\<rbrakk> \<Longrightarrow> valid_arch_state s