theory Detype_R

lemma cte_refs_notRange:
  assumes asms: "ctes_of s p = Some c"
  shows "cte_refs' (cteCap c) (irq_node' s) \<inter> base_bits = {}" proof - from cap obtain node
    where ctes_of: "ctes_of s ptr = Some (CTE (UntypedCap d base bits idx) node)" apply (clarsimp simp: cte_wp_at_ctes_of) apply (case_tac cte, simp) done show ?thesis using asms apply - apply (rule ccontr) apply (clarsimp elim!: nonemptyE) apply (frule ctes_of_valid) apply (frule valid_capAligned) apply (case_tac "\<exists>irq. cteCap c = IRQHandlerCap irq") apply (insert irq_nodes_range)[1] apply clarsimp apply (frule subsetD [OF cte_refs_capRange]) apply simp apply assumption apply (frule caps_containedD' [OF _ ctes_of _ _ contained]) apply (clarsimp dest!: isCapDs) apply (rule_tac x=x in notemptyI) apply (simp add: field_simps) apply (simp add: add_diff_eq[symmetric]) apply (drule objRefs_notrange) apply (clarsimp simp: isCap_simps) apply blast done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. cte_refs' (cteCap c) (irq_node' s) \<inter> base_bits = {} proof (state)
goal (1 subgoal):
 1. cte_refs' (cteCap c) (irq_node' s) \<inter> base_bits = {} proof (chain)
picking this:
cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d base bits idx) ptr s proof (prove)
using this:
cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d base bits idx) ptr s

goal (1 subgoal):
 1. (\<And>node. ctes_of s ptr = Some (CTE (capability.UntypedCap d base bits idx) node) \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>\<And>node. cte = CTE (capability.UntypedCap d base bits idx) node \<Longrightarrow> thesis; ctes_of s ptr = Some cte; cteCap cte = capability.UntypedCap d base bits idx\<rbrakk> \<Longrightarrow> thesis proof (prove)
goal:
No subgoals! proof (state)
this:
ctes_of s ptr = Some (CTE (capability.UntypedCap d base bits idx) node)

goal (1 subgoal):
 1. cte_refs' (cteCap c) (irq_node' s) \<inter> base_bits = {} proof (prove)
goal (1 subgoal):
 1. cte_refs' (cteCap c) (irq_node' s) \<inter> base_bits = {} proof (prove)
using this:
ctes_of s p = Some c

goal (1 subgoal):
 1. cte_refs' (cteCap c) (irq_node' s) \<inter> base_bits = {} proof (prove)
goal (1 subgoal):
 1. ctes_of s p = Some c \<Longrightarrow> cte_refs' (cteCap c) (irq_node' s) \<inter> base_bits = {} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ctes_of s p = Some c; cte_refs' (cteCap c) (irq_node' s) \<inter> base_bits \<noteq> {}\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<exists>irq. cteCap c = capability.IRQHandlerCap irq\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<exists>irq. cteCap c = capability.IRQHandlerCap irq; \<forall>irq. irq_node' s + UCAST(10 \<rightarrow> 32) irq * 0x10 \<notin> base_bits\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq\<rbrakk> \<Longrightarrow> \<forall>irq. cteCap c \<noteq> capability.IRQHandlerCap irq
 2. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq\<rbrakk> \<Longrightarrow> ?c17 x \<in> cte_refs' (cteCap c) (?x17 x)
 3. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq; ?c17 x \<in> capRange (cteCap c)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq\<rbrakk> \<Longrightarrow> ?c17 x \<in> cte_refs' (cteCap c) (?x17 x)
 2. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq; ?c17 x \<in> capRange (cteCap c)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq; x \<in> capRange (cteCap c)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq; x \<in> capRange (cteCap c)\<rbrakk> \<Longrightarrow> \<not> isUntypedCap (cteCap c)
 2. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq; x \<in> capRange (cteCap c)\<rbrakk> \<Longrightarrow> capRange (cteCap c) \<inter> untypedRange (cteCap (CTE (capability.UntypedCap d base bits idx) node)) \<noteq> {}
 3. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq; x \<in> capRange (cteCap c); capRange (cteCap c) \<subseteq> untypedRange (cteCap (CTE (capability.UntypedCap d base bits idx) node))\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq; x \<in> capRange (cteCap c)\<rbrakk> \<Longrightarrow> capRange (cteCap c) \<inter> untypedRange (cteCap (CTE (capability.UntypedCap d base bits idx) node)) \<noteq> {}
 2. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq; x \<in> capRange (cteCap c); capRange (cteCap c) \<subseteq> untypedRange (cteCap (CTE (capability.UntypedCap d base bits idx) node))\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq; x \<in> capRange (cteCap c)\<rbrakk> \<Longrightarrow> x \<in> capRange (cteCap c) \<inter> untypedRange (cteCap (CTE (capability.UntypedCap d base bits idx) node))
 2. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq; x \<in> capRange (cteCap c); capRange (cteCap c) \<subseteq> untypedRange (cteCap (CTE (capability.UntypedCap d base bits idx) node))\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<nexists>irq. cteCap c = capability.IRQHandlerCap irq; x \<in> capRange (cteCap c); capRange (cteCap c) \<subseteq> untypedRange (cteCap (CTE (capability.UntypedCap d base bits idx) node))\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>ctes_of s p = Some c; x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<forall>irq. cteCap c \<noteq> capability.IRQHandlerCap irq; x \<in> capRange (cteCap c); capRange (cteCap c) \<subseteq> base_bits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<forall>irq. cteCap c \<noteq> capability.IRQHandlerCap irq; x \<in> capRange (cteCap c); capRange (cteCap c) \<subseteq> base_bits\<rbrakk> \<Longrightarrow> \<not> isUntypedCap (cteCap c)
 2. \<And>x. \<lbrakk>x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<forall>irq. cteCap c \<noteq> capability.IRQHandlerCap irq; x \<in> capRange (cteCap c); capRange (cteCap c) \<subseteq> base_bits; capRange (cteCap c) \<inter> base_bits = {}\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> cte_refs' (cteCap c) (irq_node' s); base \<le> x; x \<le> base + (2 ^ bits - 1); valid_cap' (cteCap c) s; capAligned (cteCap c); \<forall>irq. cteCap c \<noteq> capability.IRQHandlerCap irq; x \<in> capRange (cteCap c); capRange (cteCap c) \<subseteq> base_bits; capRange (cteCap c) \<inter> base_bits = {}\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
cte_refs' (cteCap c) (irq_node' s) \<inter> base_bits = {}

goal:
No subgoals!