theory Finalise_R

lemma untyped_inc_n:
  "untyped_inc' n" using untyped_inc apply (simp add: untyped_inc'_def descendants_of'_def parency) apply clarsimp apply (drule n_cap)+ apply (clarsimp split: if_split_asm) apply (case_tac "p=slot", simp) apply clarsimp apply (erule_tac x=p in allE) apply (erule_tac x=p' in allE) apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. untyped_inc' n proof (prove)
using this:
untyped_inc' m

goal (1 subgoal):
 1. untyped_inc' n proof (prove)
goal (1 subgoal):
 1. \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<Longrightarrow> \<forall>p p' c. (\<exists>na. n p = Some (CTE c na)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. n p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<noteq> slot \<and> p \<noteq> slot \<and> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<noteq> slot \<and> p' \<noteq> slot \<and> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<noteq> slot \<and> p' \<noteq> slot \<and> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' \<noteq> slot \<and> p \<noteq> slot \<and> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c na c' n'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); n p = Some (CTE c na); isUntypedCap c; n p' = Some (CTE c' n'); isUntypedCap c'\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<noteq> slot \<and> p \<noteq> slot \<and> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<noteq> slot \<and> p' \<noteq> slot \<and> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<noteq> slot \<and> p' \<noteq> slot \<and> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' \<noteq> slot \<and> p \<noteq> slot \<and> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; \<exists>cap' node'. m p = Some (CTE cap' node') \<and> (if p = slot then c = capability.NullCap else cap' = c); \<exists>cap' node'. m p' = Some (CTE cap' node') \<and> (if p' = slot then c' = capability.NullCap else cap' = c')\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<noteq> slot \<and> p \<noteq> slot \<and> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<noteq> slot \<and> p' \<noteq> slot \<and> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<noteq> slot \<and> p' \<noteq> slot \<and> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' \<noteq> slot \<and> p \<noteq> slot \<and> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' cap' node'. \<lbrakk>m p' = Some (CTE c' node'); \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p' \<noteq> slot; p = slot \<longrightarrow> (\<exists>node'. m slot = Some (CTE cap' node')) \<and> c = capability.NullCap; p = slot \<or> (\<exists>node'. m p = Some (CTE cap' node')) \<and> cap' = c\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<noteq> slot \<and> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<noteq> slot \<and> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<noteq> slot \<and> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p \<noteq> slot \<and> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' cap' node'. \<lbrakk>m p' = Some (CTE c' node'); \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p' \<noteq> slot; p = slot \<longrightarrow> (\<exists>node'. m slot = Some (CTE cap' node')) \<and> c = capability.NullCap; p = slot \<or> (\<exists>node'. m p = Some (CTE cap' node')) \<and> cap' = c; p \<noteq> slot\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<noteq> slot \<and> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<noteq> slot \<and> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<noteq> slot \<and> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p \<noteq> slot \<and> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' node' node'a. \<lbrakk>m p' = Some (CTE c' node'); \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p' \<noteq> slot; p \<noteq> slot; m p = Some (CTE c node'a)\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' node' node'a. \<lbrakk>m p' = Some (CTE c' node'); isUntypedCap c; isUntypedCap c'; p' \<noteq> slot; p \<noteq> slot; m p = Some (CTE c node'a); \<forall>p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p'))\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' node' node'a. \<lbrakk>m p' = Some (CTE c' node'); isUntypedCap c; isUntypedCap c'; p' \<noteq> slot; p \<noteq> slot; m p = Some (CTE c node'a); \<forall>c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p'))\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal:
No subgoals!