theory CSpace_C

lemma isMDBParentOf_spec:
  notes option.case_cong_weak [cong]
  shows "\<forall>ctea cte_a cteb cte_b.
   \<Gamma> \<turnstile> {s. cslift s (cte_a_' s) = Some cte_a \<and>
            ccte_relation ctea cte_a \<and>
            cslift s (cte_b_' s) = Some cte_b \<and>
            ccte_relation cteb cte_b \<and>
            capAligned (cteCap cteb) \<and>
            (\<exists>s. s \<turnstile>' (cteCap ctea)) }
   Call isMDBParentOf_'proc
   \<lbrace> \<acute>ret__unsigned_long = from_bool (isMDBParentOf ctea cteb) \<rbrace>" supply if_cong[cong] apply (intro allI, rule conseqPre) apply vcg apply (clarsimp simp: isMDBParentOf_def) apply (frule_tac cte=ctea in ccte_relation_ccap_relation) apply (frule_tac cte=cteb in ccte_relation_ccap_relation) apply (rule conjI, clarsimp simp: typ_heap_simps dest!: lift_t_g) apply (intro conjI impI) apply (simp add: ccte_relation_def map_option_case) apply (simp add: cte_lift_def) apply (clarsimp simp: cte_to_H_def mdb_node_to_H_def split: option.split_asm) apply (clarsimp simp: Let_def to_bool_def
                    split: if_split bool.splits) apply ((clarsimp simp: typ_heap_simps dest!: lift_t_g)+)[3] apply (rule_tac x="cteCap ctea" in exI, rule conjI) apply (clarsimp simp: ccte_relation_ccap_relation typ_heap_simps
                  dest!: lift_t_g) apply (rule_tac x="cteCap cteb" in exI, rule conjI) apply (clarsimp simp: ccte_relation_ccap_relation typ_heap_simps
                  dest!: lift_t_g) apply (clarsimp simp: ccte_relation_def map_option_case) apply (simp add: cte_lift_def) apply (clarsimp simp: cte_to_H_def mdb_node_to_H_def
                 split: option.split_asm) apply (rule conjI, fastforce) \<comment> \<open>Ex (valid_cap' (cteCap ctea))\<close> apply (rule impI, rule conjI)
   \<comment> \<open>sameRegionAs = 0\<close> apply (rule impI) apply (clarsimp simp: from_bool_def
                  split: if_split bool.splits)

  \<comment> \<open>sameRegionAs \<noteq> 0\<close> apply (clarsimp simp: from_bool_def) apply (case_tac "RetypeDecls_H.sameRegionAs (cap_to_H x2b) (cap_to_H x2c)") prefer 2 apply clarsimp apply (clarsimp cong:bool.case_cong if_cong simp: typ_heap_simps) apply (rule conjI)
    \<comment> \<open>cap_get_tag of cte_a is an endpoint\<close> apply clarsimp apply (frule cap_get_tag_EndpointCap) apply simp apply (clarsimp simp: to_bool_def isNotificationCap_def isEndpointCap_def) \<comment> \<open>badge of A is not 0 now\<close> apply (subgoal_tac "cap_get_tag (cte_C.cap_C cte_b) = scast cap_endpoint_cap") \<comment> \<open>needed also after\<close> prefer 2 apply (rule sameRegionAs_EndpointCap, assumption+) apply (clarsimp simp: if_1_0_0 typ_heap_simps'   Let_def case_bool_If) apply (frule_tac cap="(cap_to_H x2c)" in cap_get_tag_EndpointCap) apply (clarsimp split: if_split_asm simp: if_distrib [where f=scast]) apply (clarsimp, rule conjI)
  \<comment> \<open>cap_get_tag of cte_a is an notification\<close> apply clarsimp apply (frule cap_get_tag_NotificationCap) apply simp apply (clarsimp simp: to_bool_def isNotificationCap_def isEndpointCap_def) \<comment> \<open>badge of A is not 0 now\<close> apply (subgoal_tac "cap_get_tag (cte_C.cap_C cte_b) = scast cap_notification_cap") \<comment> \<open>needed also after\<close> prefer 2 apply (rule sameRegionAs_NotificationCap, assumption+) apply (rule conjI, simp) apply clarsimp apply (simp add: Let_def case_bool_If) apply (frule_tac cap="(cap_to_H x2c)" in cap_get_tag_NotificationCap) apply clarsimp

  \<comment> \<open>main goal\<close> apply clarsimp apply (simp add: to_bool_def) apply (subgoal_tac "(\<not> (isEndpointCap (cap_to_H x2b))) \<and> ( \<not> (isNotificationCap (cap_to_H x2b)))") apply clarsimp apply (clarsimp simp: cap_get_tag_isCap[symmetric]) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<forall>ctea cte_a cteb cte_b. \<Gamma>\<turnstile> {s. cslift s (cte_a_' s) = Some cte_a \<and> ccte_relation ctea cte_a \<and> cslift s (cte_b_' s) = Some cte_b \<and> ccte_relation cteb cte_b \<and> capAligned (cteCap cteb) \<and> (\<exists>s. valid_cap' (cteCap ctea) s)} Call isMDBParentOf_'proc \<lbrace>\<acute>ret__unsigned_long = from_bool (isMDBParentOf ctea cteb)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<forall>ctea cte_a cteb cte_b. \<Gamma>\<turnstile> {s. cslift s (cte_a_' s) = Some cte_a \<and> ccte_relation ctea cte_a \<and> cslift s (cte_b_' s) = Some cte_b \<and> ccte_relation cteb cte_b \<and> capAligned (cteCap cteb) \<and> (\<exists>s. valid_cap' (cteCap ctea) s)} Call isMDBParentOf_'proc \<lbrace>\<acute>ret__unsigned_long = from_bool (isMDBParentOf ctea cteb)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ctea cte_a cteb cte_b. \<Gamma>\<turnstile> (?P'4 ctea cte_a cteb cte_b) Call isMDBParentOf_'proc \<lbrace>\<acute>ret__unsigned_long = from_bool (isMDBParentOf ctea cteb)\<rbrace>
 2. \<And>ctea cte_a cteb cte_b. {s. cslift s (cte_a_' s) = Some cte_a \<and> ccte_relation ctea cte_a \<and> cslift s (cte_b_' s) = Some cte_b \<and> ccte_relation cteb cte_b \<and> capAligned (cteCap cteb) \<and> (\<exists>s. valid_cap' (cteCap ctea) s)} \<subseteq> ?P'4 ctea cte_a cteb cte_b proof (prove)
goal (1 subgoal):
 1. \<And>ctea cte_a cteb cte_b. {s. cslift s (cte_a_' s) = Some cte_a \<and> ccte_relation ctea cte_a \<and> cslift s (cte_b_' s) = Some cte_b \<and> ccte_relation cteb cte_b \<and> capAligned (cteCap cteb) \<and> (\<exists>s. valid_cap' (cteCap ctea) s)} \<subseteq> {s. s \<Turnstile>\<^sub>c cte_a_' s \<and> (\<forall>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_a_' s\<rightarrow>[''cteMDBNode_C''])))) \<longrightarrow> (mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_a_' s\<rightarrow>[''cteMDBNode_C''])))) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (isMDBParentOf ctea cteb)) \<and> (mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_a_' s\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c cte_a_' s \<and> s \<Turnstile>\<^sub>c cte_b_' s \<and> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_b_' s\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs capa capb) \<longrightarrow> (from_bool (global.sameRegionAs capa capb) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (isMDBParentOf ctea cteb)) \<and> (from_bool (global.sameRegionAs capa capb) \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c cte_a_' s \<and> (\<forall>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))) \<longrightarrow> s \<Turnstile>\<^sub>c cte_a_' s \<and> (\<forall>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C''])))) \<longrightarrow> (UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))))) = SCAST(32 signed \<rightarrow> 32) 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) true = from_bool (isMDBParentOf ctea cteb)) \<and> (UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))))) \<noteq> SCAST(32 signed \<rightarrow> 32) 0 \<longrightarrow> s \<Turnstile>\<^sub>c cte_b_' s \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_b_' s\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_b_' s\<rightarrow>[''cap_C''])))) \<longrightarrow> ((if UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))))) = UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_b_' s\<rightarrow>[''cap_C'']))))) then 1 else 0) \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c cte_b_' s \<and> (\<forall>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_b_' s\<rightarrow>[''cteMDBNode_C''])))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_b_' s\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (isMDBParentOf ctea cteb))) \<and> ((if UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))))) = UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_b_' s\<rightarrow>[''cap_C'']))))) then 1 else 0) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 = from_bool (isMDBParentOf ctea cteb)))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))) \<longrightarrow> s \<Turnstile>\<^sub>c cte_a_' s \<and> (\<forall>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C''])))) \<longrightarrow> (UCAST(32 \<rightarrow> 32) (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))))) = SCAST(32 signed \<rightarrow> 32) 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) true = from_bool (isMDBParentOf ctea cteb)) \<and> (UCAST(32 \<rightarrow> 32) (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))))) \<noteq> SCAST(32 signed \<rightarrow> 32) 0 \<longrightarrow> s \<Turnstile>\<^sub>c cte_b_' s \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_b_' s\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_b_' s\<rightarrow>[''cap_C''])))) \<longrightarrow> ((if UCAST(32 \<rightarrow> 32) (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))))) = UCAST(32 \<rightarrow> 32) (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_b_' s\<rightarrow>[''cap_C'']))))) then 1 else 0) \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c cte_b_' s \<and> (\<forall>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_b_' s\<rightarrow>[''cteMDBNode_C''])))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_b_' s\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (isMDBParentOf ctea cteb))) \<and> ((if UCAST(32 \<rightarrow> 32) (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))))) = UCAST(32 \<rightarrow> 32) (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_b_' s\<rightarrow>[''cap_C'']))))) then 1 else 0) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 = from_bool (isMDBParentOf ctea cteb)))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_a_' s\<rightarrow>[''cap_C'']))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) true = from_bool (isMDBParentOf ctea cteb))))))))))} proof (prove)
goal (1 subgoal):
 1. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> x \<Turnstile>\<^sub>c cte_b_' x \<and> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs capa capb)) \<longrightarrow> (from_bool (global.sameRegionAs capa capb) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs capa capb \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> x \<Turnstile>\<^sub>c cte_b_' x \<and> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs capa capb)) \<longrightarrow> (from_bool (global.sameRegionAs capa capb) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs capa capb \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> x \<Turnstile>\<^sub>c cte_b_' x \<and> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs capa capb)) \<longrightarrow> (from_bool (global.sameRegionAs capa capb) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs capa capb \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b)\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> x \<Turnstile>\<^sub>c cte_b_' x \<and> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs capa capb)) \<longrightarrow> (from_bool (global.sameRegionAs capa capb) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs capa capb \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) = 0\<rbrakk> \<Longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)
 2. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x
 3. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x
 4. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs capa capb)) \<longrightarrow> (from_bool (global.sameRegionAs capa capb) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs capa capb \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))))))) proof (prove)
goal (4 subgoals):
 1. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; Some ctea = (case cte_lift cte_a of None \<Rightarrow> None | Some x \<Rightarrow> Some (cte_to_H x)) \<and> c_valid_cte cte_a; cslift x (cte_b_' x) = Some cte_b; Some cteb = (case cte_lift cte_b of None \<Rightarrow> None | Some x \<Rightarrow> Some (cte_to_H x)) \<and> c_valid_cte cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = 0; mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) = 0\<rbrakk> \<Longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)
 2. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x
 3. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x
 4. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs capa capb)) \<longrightarrow> (from_bool (global.sameRegionAs capa capb) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs capa capb \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))))))) proof (prove)
goal (4 subgoals):
 1. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; Some ctea = (case case cap_lift (cte_C.cap_C cte_a) of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte_a)\<rparr> of None \<Rightarrow> None | Some x \<Rightarrow> Some (cte_to_H x)) \<and> c_valid_cte cte_a; cslift x (cte_b_' x) = Some cte_b; Some cteb = (case case cap_lift (cte_C.cap_C cte_b) of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte_b)\<rparr> of None \<Rightarrow> None | Some x \<Rightarrow> Some (cte_to_H x)) \<and> c_valid_cte cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = 0; mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) = 0\<rbrakk> \<Longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)
 2. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x
 3. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x
 4. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs capa capb)) \<longrightarrow> (from_bool (global.sameRegionAs capa capb) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs capa capb \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))))))) proof (prove)
goal (4 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c. \<lbrakk>c_valid_cte cte_b; cap_lift (cte_C.cap_C cte_a) = Some x2b; ret__unsigned_' t = 0; c_valid_cte cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) = 0; cslift x (cte_a_' x) = Some cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if \<not> global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True\<rbrakk> \<Longrightarrow> False
 2. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x
 3. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x
 4. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs capa capb)) \<longrightarrow> (from_bool (global.sameRegionAs capa capb) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs capa capb \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))))))) proof (prove)
goal (4 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c. \<lbrakk>c_valid_cte cte_b; cap_lift (cte_C.cap_C cte_a) = Some x2b; ret__unsigned_' t = 0; c_valid_cte cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) = 0; cslift x (cte_a_' x) = Some cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; if mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) = 0 then False else if \<not> global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True\<rbrakk> \<Longrightarrow> False
 2. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x
 3. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x
 4. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs capa capb)) \<longrightarrow> (from_bool (global.sameRegionAs capa capb) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs capa capb \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))))))) proof (prove)
goal (1 subgoal):
 1. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> (\<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' capa) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs capa capb)) \<longrightarrow> (from_bool (global.sameRegionAs capa capb) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs capa capb \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))))))) proof (prove)
goal (2 subgoals):
 1. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> ccap_relation (cteCap ctea) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))
 2. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' (cteCap ctea)) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cteCap ctea) capb)) \<longrightarrow> (from_bool (global.sameRegionAs (cteCap ctea) capb) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs (cteCap ctea) capb \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)))))) proof (prove)
goal (1 subgoal):
 1. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>capb. ccap_relation capb (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) \<and> capAligned capb \<and> Ex (valid_cap' (cteCap ctea)) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cteCap ctea) capb)) \<longrightarrow> (from_bool (global.sameRegionAs (cteCap ctea) capb) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs (cteCap ctea) capb \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)))))) proof (prove)
goal (2 subgoals):
 1. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> ccap_relation (cteCap cteb) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))
 2. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> capAligned (cteCap cteb) \<and> Ex (valid_cap' (cteCap ctea)) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cteCap ctea) (cteCap cteb))) \<longrightarrow> (from_bool (global.sameRegionAs (cteCap ctea) (cteCap cteb)) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs (cteCap ctea) (cteCap cteb) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)))))) proof (prove)
goal (1 subgoal):
 1. \<And>ctea cte_a cteb cte_b x s. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; ccte_relation ctea cte_a; cslift x (cte_b_' x) = Some cte_b; ccte_relation cteb cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); \<exists>t. ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> capAligned (cteCap cteb) \<and> Ex (valid_cap' (cteCap ctea)) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cteCap ctea) (cteCap cteb))) \<longrightarrow> (from_bool (global.sameRegionAs (cteCap ctea) (cteCap cteb)) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs (cteCap ctea) (cteCap cteb) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)))))) proof (prove)
goal (1 subgoal):
 1. \<And>ctea cte_a cteb cte_b x s t. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); Some ctea = (case cte_lift cte_a of None \<Rightarrow> None | Some x \<Rightarrow> Some (cte_to_H x)); c_valid_cte cte_a; Some cteb = (case cte_lift cte_b of None \<Rightarrow> None | Some x \<Rightarrow> Some (cte_to_H x)); c_valid_cte cte_b\<rbrakk> \<Longrightarrow> Ex (valid_cap' (cteCap ctea)) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cteCap ctea) (cteCap cteb))) \<longrightarrow> (from_bool (global.sameRegionAs (cteCap ctea) (cteCap cteb)) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs (cteCap ctea) (cteCap cteb) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)))))) proof (prove)
goal (1 subgoal):
 1. \<And>ctea cte_a cteb cte_b x s t. \<lbrakk>cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cteCap cteb); valid_cap' (cteCap ctea) s; ccap_relation (cteCap ctea) (cte_C.cap_C cte_a); ccap_relation (cteCap cteb) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); Some ctea = (case case cap_lift (cte_C.cap_C cte_a) of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte_a)\<rparr> of None \<Rightarrow> None | Some x \<Rightarrow> Some (cte_to_H x)); c_valid_cte cte_a; Some cteb = (case case cap_lift (cte_C.cap_C cte_b) of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte_b)\<rparr> of None \<Rightarrow> None | Some x \<Rightarrow> Some (cte_to_H x)); c_valid_cte cte_b\<rbrakk> \<Longrightarrow> Ex (valid_cap' (cteCap ctea)) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cteCap ctea) (cteCap cteb))) \<longrightarrow> (from_bool (global.sameRegionAs (cteCap ctea) (cteCap cteb)) = 0 \<longrightarrow> \<not> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (global.sameRegionAs (cteCap ctea) (cteCap cteb) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (case ctea of CTE a mdbA \<Rightarrow> case cteb of CTE b mdbB \<Rightarrow> if Not $ mdbRevocable mdbA then False else if Not $ a `~global.sameRegionAs~` b then False else if True then if isEndpointCap a \<and> capEPBadge a \<noteq> 0 then let badge = capEPBadge a in badge = capEPBadge b \<and> (Not $ mdbFirstBadged mdbB) else if isNotificationCap a \<and> capNtfnBadge a \<noteq> 0 then let badge = capNtfnBadge a in badge = capNtfnBadge b \<and> (Not $ mdbFirstBadged mdbB) else True else undefined)))))) proof (prove)
goal (1 subgoal):
 1. \<And>cte_a cte_b x s t x2b x2c. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c\<rbrakk> \<Longrightarrow> Ex (valid_cap' (cap_to_H x2b)) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c))) \<longrightarrow> (from_bool (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c)) = 0 \<longrightarrow> \<not> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if \<not> global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)))))) proof (prove)
goal (1 subgoal):
 1. \<And>cte_a cte_b x s t x2b x2c. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c))) \<longrightarrow> (from_bool (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c)) = 0 \<longrightarrow> \<not> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if \<not> global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))))) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; \<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c))\<rbrakk> \<Longrightarrow> from_bool (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c)) = 0 \<longrightarrow> \<not> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if \<not> global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)
 2. \<And>cte_a cte_b x s t x2b x2c. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; \<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c))\<rbrakk> \<Longrightarrow> global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)))) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; \<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c)); from_bool (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c)) = 0\<rbrakk> \<Longrightarrow> \<not> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if \<not> global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)
 2. \<And>cte_a cte_b x s t x2b x2c. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; \<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c))\<rbrakk> \<Longrightarrow> global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)))) proof (prove)
goal (1 subgoal):
 1. \<And>cte_a cte_b x s t x2b x2c. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; \<exists>t. ret__unsigned_long_' t = from_bool (global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c))\<rbrakk> \<Longrightarrow> global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> from_bool (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)))) proof (prove)
goal (1 subgoal):
 1. \<And>cte_a cte_b x s t x2b x2c ta. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)))) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))))
 2. \<And>cte_a cte_b x s t x2b x2c ta. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); \<not> global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)))) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); \<not> global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))))
 2. \<And>cte_a cte_b x s t x2b x2c ta. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)))) proof (prove)
goal (1 subgoal):
 1. \<And>cte_a cte_b x s t x2b x2c ta. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_a_' x\<rightarrow>[''cteMDBNode_C''])))); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_a_' x \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))) = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C'']))))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) = capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> x \<Turnstile>\<^sub>c cte_b_' x \<and> ((\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_b_' x\<rightarrow>[''cteMDBNode_C''])))) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C''])))) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_b_' x\<rightarrow>[''cap_C''])))) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) = 0))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_a_' x\<rightarrow>[''cap_C'']))) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)))) proof (prove)
goal (1 subgoal):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True))) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))\<rbrakk> \<Longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)); (cap_get_tag (cte_C.cap_C cte_a) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) = (cap_to_H x2b = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))))\<rbrakk> \<Longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) s; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))\<rbrakk> \<Longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isNotificationCap (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) 0 (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) \<and> capNtfnBadge (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) 0 (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) \<noteq> 0 then capNtfnBadge (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) 0 (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) \<and> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) \<and> capNtfnBadge (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) \<noteq> 0 then capNtfnBadge (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) then capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) \<and> capNtfnBadge (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) \<noteq> 0 then capNtfnBadge (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))))) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) proof (prove)
goal (3 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0; cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap
 3. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) proof (prove)
goal (3 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap
 2. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0; cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0))
 3. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0; cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc td. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0; cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' td = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))\<rbrakk> \<Longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (if if capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True then 1 else 0)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge (cap_to_H x2c) \<longrightarrow> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) \<noteq> 0)
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc td. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a))) (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0; cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' td = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)); (cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) = (cap_to_H x2c = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)))))\<rbrakk> \<Longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (if if capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True then 1 else 0)) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift (cte_C.cap_C cte_a)) = capEPBadge (cap_to_H x2c) \<longrightarrow> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) \<noteq> 0)
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) proof (prove)
goal (1 subgoal):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))\<rbrakk> \<Longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)); (cap_get_tag (cte_C.cap_C cte_a) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) = (cap_to_H x2b = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))))\<rbrakk> \<Longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) s; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))\<rbrakk> \<Longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = 0 \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) 0 (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) \<and> capEPBadge (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) 0 (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) \<noteq> 0 then capEPBadge (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) 0 (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0 \<longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) \<and> capEPBadge (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) \<noteq> 0 then capEPBadge (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) \<and> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) \<and> capEPBadge (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) \<noteq> 0 then capEPBadge (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))))) then capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (3 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0; cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap
 3. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (3 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap
 2. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0; cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0))
 3. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0; cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a) \<and> ((\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0))
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0; cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc td. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0; cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' td = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))\<rbrakk> \<Longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (case if capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True of True \<Rightarrow> 1 | False \<Rightarrow> 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (case capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 of True \<Rightarrow> 1 | False \<Rightarrow> 0) = 0)
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc td. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0; cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' td = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))\<rbrakk> \<Longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (if if capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True then 1 else 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge (cap_to_H x2c) \<longrightarrow> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) \<noteq> 0)
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb tc td. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) s; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0)) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' tc = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)); cap_to_H x2b = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a))) (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0); capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> 0; cap_get_tag (cte_C.cap_C cte_b) = cap_get_tag (cte_C.cap_C cte_a); ret__unsigned_' td = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)); (cap_get_tag (cte_C.cap_C cte_b) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) = (cap_to_H x2c = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)))))\<rbrakk> \<Longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) \<longrightarrow> (if mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 then 1 else 0) = (if if capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<noteq> 0 then capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True then 1 else 0)) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_b)) \<longrightarrow> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C cte_a)) = capNtfnBadge (cap_to_H x2c) \<longrightarrow> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) \<noteq> 0)
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (1 subgoal):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a) \<longrightarrow> (if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True) proof (prove)
goal (1 subgoal):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> if \<not> to_bool (mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a))) then False else if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> \<not> to_bool (mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b))) else True proof (prove)
goal (1 subgoal):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True proof (prove)
goal (2 subgoals):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); \<not> isEndpointCap (cap_to_H x2b) \<and> \<not> isNotificationCap (cap_to_H x2b)\<rbrakk> \<Longrightarrow> if isEndpointCap (cap_to_H x2b) \<and> capEPBadge (cap_to_H x2b) \<noteq> 0 then capEPBadge (cap_to_H x2b) = capEPBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else if isNotificationCap (cap_to_H x2b) \<and> capNtfnBadge (cap_to_H x2b) \<noteq> 0 then capNtfnBadge (cap_to_H x2b) = capNtfnBadge (cap_to_H x2c) \<and> mdbFirstBadged_CL (mdb_node_lift (cteMDBNode_C cte_b)) = 0 else True
 2. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> \<not> isEndpointCap (cap_to_H x2b) \<and> \<not> isNotificationCap (cap_to_H x2b) proof (prove)
goal (1 subgoal):
 1. \<And>cte_a cte_b x s t x2b x2c ta tb. \<lbrakk>c_valid_cte cte_b; cslift x (cte_a_' x) = Some cte_a; cslift x (cte_b_' x) = Some cte_b; capAligned (cap_to_H x2c); valid_cap' (cap_to_H x2b) s; ccap_relation (cap_to_H x2b) (cte_C.cap_C cte_a); ccap_relation (cap_to_H x2c) (cte_C.cap_C cte_b); mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)) \<noteq> 0; ret__unsigned_' t = mdbRevocable_CL (mdb_node_lift (cteMDBNode_C cte_a)); cap_lift (cte_C.cap_C cte_a) = Some x2b; c_valid_cte cte_a; cap_lift (cte_C.cap_C cte_b) = Some x2c; ret__unsigned_long_' ta = 1; global.sameRegionAs (cap_to_H x2b) (cap_to_H x2c); ret__unsigned_' tb = cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a); SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cte_C.cap_C cte_a)\<rbrakk> \<Longrightarrow> \<not> isEndpointCap (cap_to_H x2b) \<and> \<not> isNotificationCap (cap_to_H x2b) proof (prove)
goal:
No subgoals!