theory ArchCSpace_AI

lemma cap_insert_valid_arch_caps [CSpace_AI_assms]:
  "\<lbrace>valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)\<rbrace>
     cap_insert cap src dest
   \<lbrace>\<lambda>rv. valid_arch_caps\<rbrace>" apply (simp add: cap_insert_def) apply (rule hoare_pre) apply (wp set_cap_valid_arch_caps get_cap_wp set_untyped_cap_as_full_valid_arch_caps
               | simp split del: if_split)+ apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift set_untyped_cap_as_full_cte_wp_at_neg
                set_untyped_cap_as_full_is_final_cap'_neg set_untyped_cap_as_full_cte_wp_at hoare_vcg_ball_lift
                hoare_vcg_ex_lift hoare_vcg_disj_lift | wps)+ apply (wp set_untyped_cap_as_full_obj_at_impossible) apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift set_untyped_cap_as_full_cte_wp_at_neg
    set_untyped_cap_as_full_is_final_cap'_neg hoare_vcg_ball_lift
    hoare_vcg_ex_lift | wps)+ apply (wp set_untyped_cap_as_full_obj_at_impossible) apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift set_untyped_cap_as_full_cte_wp_at_neg
    set_untyped_cap_as_full_is_final_cap'_neg hoare_vcg_ball_lift
    hoare_vcg_ex_lift | wps)+ apply (rule hoare_strengthen_post) prefer 2 apply (erule iffD2[OF caps_of_state_cteD']) apply (wp set_untyped_cap_as_full_cte_wp_at hoare_vcg_all_lift hoare_vcg_imp_lift
            set_untyped_cap_as_full_cte_wp_at_neg hoare_vcg_ex_lift | clarsimp)+ apply (rule hoare_strengthen_post) prefer 2 apply (erule iffD2[OF caps_of_state_cteD']) apply (wp set_untyped_cap_as_full_cte_wp_at hoare_vcg_all_lift hoare_vcg_imp_lift
         set_untyped_cap_as_full_cte_wp_at_neg hoare_vcg_ex_lift | clarsimp)+ apply (wp get_cap_wp)+ apply (intro conjI allI impI disj_subst) apply simp apply clarsimp defer apply (clarsimp simp:valid_arch_caps_def cte_wp_at_caps_of_state) apply (drule(1) unique_table_refs_no_cap_asidD) apply (frule is_derived_obj_refs) apply (frule is_derived_cap_asid_issues) apply (frule is_derived_is_cap) apply (clarsimp simp:no_cap_to_obj_with_diff_ref_def  Ball_def
          del:disjCI dest!: derived_cap_master_cap_eq) apply (drule table_cap_ref_eq_rewrite) apply clarsimp apply (erule_tac x=a in allE, erule_tac x=b in allE) apply simp apply simp apply (clarsimp simp:obj_at_def is_cap_simps valid_arch_caps_def) apply (frule(1) valid_table_capsD) apply (clarsimp simp:cte_wp_at_caps_of_state) apply (drule is_derived_is_pt_pd) apply (clarsimp simp:is_derived_def is_cap_simps) apply (clarsimp simp:cte_wp_at_caps_of_state) apply (frule is_derived_cap_asid_issues) apply (clarsimp simp:is_cap_simps) apply (clarsimp simp:cte_wp_at_caps_of_state) apply (frule is_derived_obj_refs) apply (drule_tac x = p in bspec) apply fastforce apply (clarsimp simp:obj_at_def empty_table_caps_of) apply (clarsimp simp:empty_table_caps_of valid_arch_caps_def) apply (frule(1) valid_table_capsD) apply (clarsimp simp:cte_wp_at_caps_of_state is_derived_is_pt_pd) apply (clarsimp simp:cte_wp_at_caps_of_state) apply (frule is_derived_cap_asid_issues) apply (clarsimp simp:is_cap_simps) apply (clarsimp simp:cte_wp_at_caps_of_state) apply (frule is_derived_obj_refs) apply (drule_tac x = x in bspec) apply fastforce subgoal by (clarsimp simp:obj_at_def empty_table_caps_of) apply (clarsimp simp:is_cap_simps cte_wp_at_caps_of_state) apply (frule is_derived_is_pt_pd) apply (frule is_derived_obj_refs) apply (frule is_derived_cap_asid_issues) apply (clarsimp simp:is_cap_simps valid_arch_caps_def cap_master_cap_def
                            is_derived_def is_derived_arch_def) apply (drule_tac ptr = src and ptr' = "(x,xa)" in unique_table_capsD) apply (simp add:is_cap_simps)+ apply (clarsimp simp:is_cap_simps cte_wp_at_caps_of_state) apply (frule is_derived_is_pt_pd) apply (frule is_derived_obj_refs) apply (frule is_derived_cap_asid_issues) apply (clarsimp simp:is_cap_simps valid_arch_caps_def
                        cap_master_cap_def cap_master_arch_cap_def
                        is_derived_def is_derived_arch_def) apply (drule_tac ptr = src and ptr' = "(x,xa)" in unique_table_capsD) apply (simp add:is_cap_simps)+ apply (auto simp:cte_wp_at_caps_of_state) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)\<rbrace> cap_insert cap src dest \<lbrace>\<lambda>rv. valid_arch_caps\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)\<rbrace> do src_cap <- get_cap src;
old_cap <- get_cap dest;
y <- assert (old_cap = NullCap);
y <- set_untyped_cap_as_full src_cap cap src;
y <- set_cap cap dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) then Some src else cdt src));
y <- do_extended_op (cap_insert_ext (should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap)) src dest src_p dest_p);
set_original dest (is_cap_revocable cap src_cap)
od \<lbrace>\<lambda>rv. valid_arch_caps\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q\<rbrace> do src_cap <- get_cap src;
old_cap <- get_cap dest;
y <- assert (old_cap = NullCap);
y <- set_untyped_cap_as_full src_cap cap src;
y <- set_cap cap dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) then Some src else cdt src));
y <- do_extended_op (cap_insert_ext (should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap)) src dest src_p dest_p);
set_original dest (is_cap_revocable cap src_cap)
od \<lbrace>\<lambda>rv. valid_arch_caps\<rbrace>
 2. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s proof (prove)
goal (5 subgoals):
 1. \<And>src_cap x. \<lbrace>?P'36 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. (\<forall>vref cap'. cte_wp_at ((=) cap') dest s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs cap' \<or> \<not> is_final_cap' cap' s \<and> \<not> reachable_pg_cap cap' s \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {dest} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap cap' \<or> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest)) \<and> (is_pd_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest))\<rbrace>
 2. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> ?P'36 src_cap x y s\<rbrace>
 3. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 4. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 5. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s proof (prove)
goal (6 subgoals):
 1. \<And>src_cap x r prev_s. r \<in> obj_refs cap \<Longrightarrow> \<lbrace>?P103 src_cap x r prev_s\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv. obj_at (empty_table (set (second_level_tables (arch_state prev_s)))) r\<rbrace>
 2. \<And>src_cap x. \<lbrace>?P'89 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap cap' \<or> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest)) \<and> (is_pd_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest))\<rbrace>
 3. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>xa\<in>obj_refs cap. ?P104 src_cap x y xa s)) \<and> ?P'89 src_cap x y s\<rbrace>
 4. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 5. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 6. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s
flex-flex pairs:
\<lambda>src_cap x. ?P104 src_cap x () \<equiv>\<^sup>? \<lambda>src_cap x r s. ?P103 src_cap x r s s proof (prove)
goal (5 subgoals):
 1. \<And>src_cap x. \<lbrace>?P'89 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap cap' \<or> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest)) \<and> (is_pd_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest))\<rbrace>
 2. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> ?P'89 src_cap x y s\<rbrace>
 3. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 4. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 5. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s proof (prove)
goal (6 subgoals):
 1. \<And>src_cap x r prev_s. r \<in> obj_refs cap \<Longrightarrow> \<lbrace>?P129 src_cap x r prev_s\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv. obj_at (empty_table (set (second_level_tables (arch_state prev_s)))) r\<rbrace>
 2. \<And>src_cap x. \<lbrace>?P'115 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. (is_pt_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap cap' \<or> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest)) \<and> (is_pd_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest))\<rbrace>
 3. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pd_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>xa\<in>obj_refs cap. ?P130 src_cap x y xa s)) \<and> ?P'115 src_cap x y s\<rbrace>
 4. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 5. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 6. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s
flex-flex pairs:
\<lambda>src_cap x. ?P130 src_cap x () \<equiv>\<^sup>? \<lambda>src_cap x r s. ?P129 src_cap x r s s proof (prove)
goal (5 subgoals):
 1. \<And>src_cap x. \<lbrace>?P'115 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. (is_pt_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap cap' \<or> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest)) \<and> (is_pd_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest))\<rbrace>
 2. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pd_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> ?P'115 src_cap x y s\<rbrace>
 3. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 4. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 5. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s proof (prove)
goal (7 subgoals):
 1. \<And>src_cap x prev_s oldcap. \<lbrace>\<lambda>a. ?P160 src_cap x prev_s a oldcap\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>a b. caps_of_state b dest = Some oldcap \<and> (is_pt_cap oldcap \<and> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<and> obj_refs oldcap = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap oldcap \<and> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<and> obj_refs oldcap = obj_refs cap)\<rbrace>
 2. \<And>src_cap x. \<lbrace>?Q'148 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. \<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap cap' \<or> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest\<rbrace>
 3. \<And>src_cap x. \<lbrace>?P'141 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. is_pd_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest)\<rbrace>
 4. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pd_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pt_cap cap \<or> (\<exists>xa. ?P159 src_cap x y s xa) \<or> ?Q'148 src_cap x y s) \<and> ?P'141 src_cap x y s\<rbrace>
 5. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 6. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 7. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s
flex-flex pairs:
\<lambda>src_cap x s. ?P160 src_cap x s s \<equiv>\<^sup>? \<lambda>src_cap x. ?P159 src_cap x () proof (prove)
goal (8 subgoals):
 1. \<And>src_cap x prev_s oldcap. \<lbrace>\<lambda>a. ?P165 src_cap x prev_s a oldcap\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>?Q162 src_cap x prev_s oldcap\<rbrace>
 2. \<And>src_cap x prev_s oldcap rv s. ?Q162 src_cap x prev_s oldcap rv s \<Longrightarrow> caps_of_state s dest = Some oldcap \<and> (is_pt_cap oldcap \<and> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<and> obj_refs oldcap = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap oldcap \<and> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<and> obj_refs oldcap = obj_refs cap)
 3. \<And>src_cap x. \<lbrace>?Q'148 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. \<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap cap' \<or> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest\<rbrace>
 4. \<And>src_cap x. \<lbrace>?P'141 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. is_pd_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest)\<rbrace>
 5. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pd_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pt_cap cap \<or> (\<exists>xa. ?P159 src_cap x y s xa) \<or> ?Q'148 src_cap x y s) \<and> ?P'141 src_cap x y s\<rbrace>
 6. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 7. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 8. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s
flex-flex pairs:
\<lambda>src_cap x s. ?P165 src_cap x s s \<equiv>\<^sup>? \<lambda>src_cap x. ?P159 src_cap x () proof (prove)
goal (8 subgoals):
 1. \<And>src_cap x prev_s oldcap rv s. ?Q162 src_cap x prev_s oldcap rv s \<Longrightarrow> caps_of_state s dest = Some oldcap \<and> (is_pt_cap oldcap \<and> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<and> obj_refs oldcap = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap oldcap \<and> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<and> obj_refs oldcap = obj_refs cap)
 2. \<And>src_cap x prev_s oldcap. \<lbrace>\<lambda>a. ?P165 src_cap x prev_s a oldcap\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>?Q162 src_cap x prev_s oldcap\<rbrace>
 3. \<And>src_cap x. \<lbrace>?Q'148 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. \<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap cap' \<or> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest\<rbrace>
 4. \<And>src_cap x. \<lbrace>?P'141 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. is_pd_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest)\<rbrace>
 5. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pd_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pt_cap cap \<or> (\<exists>xa. ?P159 src_cap x y s xa) \<or> ?Q'148 src_cap x y s) \<and> ?P'141 src_cap x y s\<rbrace>
 6. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 7. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 8. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s
flex-flex pairs:
\<lambda>src_cap x s. ?P165 src_cap x s s \<equiv>\<^sup>? \<lambda>src_cap x. ?P159 src_cap x () proof (prove)
goal (7 subgoals):
 1. \<And>src_cap x prev_s oldcap. \<lbrace>\<lambda>a. ?P165 src_cap x prev_s a oldcap\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv. cte_wp_at ((=) oldcap and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest\<rbrace>
 2. \<And>src_cap x. \<lbrace>?Q'148 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. \<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap cap' \<or> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest\<rbrace>
 3. \<And>src_cap x. \<lbrace>?P'141 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. is_pd_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s dest = Some oldcap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<and> (is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest)\<rbrace>
 4. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pd_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pt_cap cap \<or> (\<exists>xa. ?P159 src_cap x y s xa) \<or> ?Q'148 src_cap x y s) \<and> ?P'141 src_cap x y s\<rbrace>
 5. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 6. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 7. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s
flex-flex pairs:
\<lambda>src_cap x s. ?P165 src_cap x s s \<equiv>\<^sup>? \<lambda>src_cap x. ?P159 src_cap x () proof (prove)
goal (6 subgoals):
 1. \<And>src_cap x oldcap. \<lbrace>\<lambda>a. ?P201 src_cap x () a oldcap\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>a b. caps_of_state b dest = Some oldcap \<and> (is_pt_cap cap \<and> is_pt_cap oldcap \<and> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<and> obj_refs oldcap = obj_refs cap \<or> is_pd_cap oldcap \<and> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<and> obj_refs oldcap = obj_refs cap)\<rbrace>
 2. \<And>src_cap x. \<lbrace>?Q'194 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. \<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest\<rbrace>
 3. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pd_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pt_cap cap \<or> (\<exists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) src_cap) src s) \<or> (\<forall>x xa. ((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> (x, xa) = dest)) \<and> (\<not> is_pd_cap cap \<or> (\<exists>xa. ?P201 src_cap x y s xa) \<or> ?Q'194 src_cap x y s)\<rbrace>
 4. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 5. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 6. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s proof (prove)
goal (7 subgoals):
 1. \<And>src_cap x oldcap. \<lbrace>?P205 src_cap x () oldcap\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>?Q204 src_cap x oldcap\<rbrace>
 2. \<And>src_cap x oldcap rv s. ?Q204 src_cap x oldcap rv s \<Longrightarrow> caps_of_state s dest = Some oldcap \<and> (is_pt_cap cap \<and> is_pt_cap oldcap \<and> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<and> obj_refs oldcap = obj_refs cap \<or> is_pd_cap oldcap \<and> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<and> obj_refs oldcap = obj_refs cap)
 3. \<And>src_cap x. \<lbrace>?Q'194 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. \<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest\<rbrace>
 4. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pd_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pt_cap cap \<or> (\<exists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) src_cap) src s) \<or> (\<forall>x xa. ((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> (x, xa) = dest)) \<and> (\<not> is_pd_cap cap \<or> (\<exists>xa. ?P205 src_cap x y xa s) \<or> ?Q'194 src_cap x y s)\<rbrace>
 5. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 6. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 7. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s proof (prove)
goal (7 subgoals):
 1. \<And>src_cap x oldcap rv s. ?Q204 src_cap x oldcap rv s \<Longrightarrow> caps_of_state s dest = Some oldcap \<and> (is_pt_cap cap \<and> is_pt_cap oldcap \<and> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<and> obj_refs oldcap = obj_refs cap \<or> is_pd_cap oldcap \<and> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<and> obj_refs oldcap = obj_refs cap)
 2. \<And>src_cap x oldcap. \<lbrace>?P205 src_cap x () oldcap\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>?Q204 src_cap x oldcap\<rbrace>
 3. \<And>src_cap x. \<lbrace>?Q'194 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. \<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest\<rbrace>
 4. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pd_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pt_cap cap \<or> (\<exists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) src_cap) src s) \<or> (\<forall>x xa. ((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> (x, xa) = dest)) \<and> (\<not> is_pd_cap cap \<or> (\<exists>xa. ?P205 src_cap x y xa s) \<or> ?Q'194 src_cap x y s)\<rbrace>
 5. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 6. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 7. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s proof (prove)
goal (6 subgoals):
 1. \<And>src_cap x oldcap. \<lbrace>?P205 src_cap x () oldcap\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv. cte_wp_at ((=) oldcap and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest\<rbrace>
 2. \<And>src_cap x. \<lbrace>?Q'194 src_cap x ()\<rbrace> set_untyped_cap_as_full src_cap cap src \<lbrace>\<lambda>rv s. \<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = dest\<rbrace>
 3. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>y s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pd_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pt_cap cap \<or> (\<exists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) src_cap) src s) \<or> (\<forall>x xa. ((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> (x, xa) = dest)) \<and> (\<not> is_pd_cap cap \<or> (\<exists>xa. ?P205 src_cap x y xa s) \<or> ?Q'194 src_cap x y s)\<rbrace>
 4. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 5. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 6. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s proof (prove)
goal (4 subgoals):
 1. \<And>src_cap. \<lbrace>?P'233 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>x s. x \<noteq> NullCap\<rbrace>
 2. \<And>src_cap. \<lbrace>?Q'233 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>rv s. (valid_arch_caps and cte_wp_at ((=) src_cap) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) src_cap) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) src_cap) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pd_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pt_cap cap \<or> (\<exists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) src_cap) src s) \<or> (\<forall>x xa. ((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> (x, xa) = dest)) \<and> (\<not> is_pd_cap cap \<or> (\<exists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) src_cap) src s) \<or> (\<forall>x xa. ((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) src_cap) src s \<or> (x, xa) = dest))\<rbrace>
 3. \<lbrace>?Q\<rbrace> get_cap src \<lbrace>\<lambda>src_cap s. ?P'233 src_cap s \<or> ?Q'233 src_cap s\<rbrace>
 4. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> ?Q s proof (prove)
goal (1 subgoal):
 1. \<And>s. (valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s \<Longrightarrow> \<forall>capa. cte_wp_at ((=) capa) src s \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap) \<or> (\<forall>capb. cte_wp_at ((=) capb) dest s \<longrightarrow> (valid_arch_caps and cte_wp_at ((=) capa) src) s \<and> (\<forall>x xa. (dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) capa) src s \<or> vs_cap_ref xa \<noteq> Some x \<or> vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa \<or> (\<not> is_final_cap' xa s \<and> cte_wp_at ((=) capa) src s) \<and> \<not> reachable_pg_cap xa s \<or> (\<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s)) \<and> (no_cap_to_obj_with_diff_ref cap {dest} s \<and> cte_wp_at ((=) capa) src s) \<and> (\<not> is_pt_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pd_cap cap \<or> cap_asid cap \<noteq> None \<or> (\<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {}))) \<and> (\<not> is_pt_cap cap \<or> (\<exists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s) \<or> (\<forall>x xa. ((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s \<or> (x, xa) = dest)) \<and> (\<not> is_pd_cap cap \<or> (\<exists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s) \<or> (\<forall>x xa. ((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s \<or> (x, xa) = dest))) proof (prove)
goal (8 subgoals):
 1. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> (valid_arch_caps and cte_wp_at ((=) capa) src) s
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> ((dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) capa) src s); \<not> vs_cap_ref xa \<noteq> Some x; \<not> (vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa); \<not> ((\<not> is_final_cap' xa s \<and> cte_wp_at ((=) capa) src s) \<and> \<not> reachable_pg_cap xa s)\<rbrakk> \<Longrightarrow> \<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref cap {dest} s
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 5. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 6. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 7. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 8. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest proof (prove)
goal (7 subgoals):
 1. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> ((dest \<noteq> src \<and> \<not> cte_wp_at ((=) xa) dest s \<or> dest = src \<and> \<not> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s) \<and> cte_wp_at ((=) capa) src s); \<not> vs_cap_ref xa \<noteq> Some x; \<not> (vs_cap_ref cap = Some x \<and> obj_refs cap = obj_refs xa); \<not> ((\<not> is_final_cap' xa s \<and> cte_wp_at ((=) capa) src s) \<and> \<not> reachable_pg_cap xa s)\<rbrakk> \<Longrightarrow> \<forall>xa\<in>obj_refs xa. (x, xa) \<notin> vs_lookup_pages s
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref cap {dest} s
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest proof (prove)
goal (7 subgoals):
 1. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref cap {dest} s
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest proof (prove)
goal (7 subgoals):
 1. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref cap {dest} s
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (7 subgoals):
 1. \<And>s capa. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src cap capa\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref cap {dest} s
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (7 subgoals):
 1. \<And>s capa. \<lbrakk>caps_of_state s dest = Some NullCap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src cap capa; no_cap_to_obj_with_diff_ref capa {} s\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref cap {dest} s
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (7 subgoals):
 1. \<And>s capa. \<lbrakk>caps_of_state s dest = Some NullCap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src cap capa; no_cap_to_obj_with_diff_ref capa {} s; obj_refs cap = obj_refs capa\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref cap {dest} s
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (7 subgoals):
 1. \<And>s capa. \<lbrakk>caps_of_state s dest = Some NullCap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src cap capa; no_cap_to_obj_with_diff_ref capa {} s; obj_refs cap = obj_refs capa; (is_pt_cap cap \<or> is_pd_cap cap \<longrightarrow> cap_asid cap \<noteq> None) \<and> (is_pg_cap cap \<or> vs_cap_ref cap = vs_cap_ref capa)\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref cap {dest} s
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (7 subgoals):
 1. \<And>s capa. \<lbrakk>caps_of_state s dest = Some NullCap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src cap capa; no_cap_to_obj_with_diff_ref capa {} s; obj_refs cap = obj_refs capa; (is_pt_cap cap \<or> is_pd_cap cap \<longrightarrow> cap_asid cap \<noteq> None) \<and> (is_pg_cap cap \<or> vs_cap_ref cap = vs_cap_ref capa); is_pg_cap cap = is_pg_cap capa \<and> is_pt_cap cap = is_pt_cap capa \<and> is_pd_cap cap = is_pd_cap capa \<and> is_ep_cap cap = is_ep_cap capa \<and> is_ntfn_cap cap = is_ntfn_cap capa \<and> is_cnode_cap cap = is_cnode_cap capa \<and> is_thread_cap cap = is_thread_cap capa \<and> is_zombie cap = is_zombie capa \<and> is_arch_cap cap = is_arch_cap capa \<and> cap_is_device cap = cap_is_device capa\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref cap {dest} s
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (7 subgoals):
 1. \<And>s capa a b. \<lbrakk>caps_of_state s dest = Some NullCap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs capa \<and> table_cap_ref c \<noteq> table_cap_ref capa) (a, b) s; obj_refs cap = obj_refs capa; cap_master_cap cap = cap_master_cap capa; is_pt_cap capa \<longrightarrow> (\<exists>y. cap_asid cap = Some y); is_pg_cap cap = is_pg_cap capa; is_pd_cap capa \<longrightarrow> (\<exists>y. cap_asid cap = Some y); is_pg_cap capa \<or> vs_cap_ref cap = vs_cap_ref capa; is_pt_cap cap = is_pt_cap capa; is_pd_cap cap = is_pd_cap capa; is_ep_cap cap = is_ep_cap capa; is_ntfn_cap cap = is_ntfn_cap capa; is_cnode_cap cap = is_cnode_cap capa; is_thread_cap cap = is_thread_cap capa; is_zombie cap = is_zombie capa; is_arch_cap cap = is_arch_cap capa; cap_is_device cap = cap_is_device capa; (a, b) \<noteq> dest; cte_wp_at (\<lambda>c. obj_refs c = obj_refs capa \<and> table_cap_ref c \<noteq> table_cap_ref cap) (a, b) s\<rbrakk> \<Longrightarrow> False
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (8 subgoals):
 1. \<And>s capa a b. \<lbrakk>caps_of_state s dest = Some NullCap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs capa \<and> table_cap_ref c \<noteq> table_cap_ref capa) (a, b) s; obj_refs cap = obj_refs capa; is_pt_cap capa \<longrightarrow> (\<exists>y. cap_asid cap = Some y); is_pg_cap cap = is_pg_cap capa; is_pd_cap capa \<longrightarrow> (\<exists>y. cap_asid cap = Some y); is_pg_cap capa \<or> vs_cap_ref cap = vs_cap_ref capa; is_pt_cap cap = is_pt_cap capa; is_pd_cap cap = is_pd_cap capa; is_ep_cap cap = is_ep_cap capa; is_ntfn_cap cap = is_ntfn_cap capa; is_cnode_cap cap = is_cnode_cap capa; is_thread_cap cap = is_thread_cap capa; is_zombie cap = is_zombie capa; is_arch_cap cap = is_arch_cap capa; cap_is_device cap = cap_is_device capa; (a, b) \<noteq> dest; cte_wp_at (\<lambda>c. obj_refs c = obj_refs capa \<and> table_cap_ref c \<noteq> table_cap_ref cap) (a, b) s\<rbrakk> \<Longrightarrow> is_pg_cap cap \<or> vs_cap_ref cap = vs_cap_ref capa
 2. \<And>s capa a b. \<lbrakk>caps_of_state s dest = Some NullCap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs capa \<and> table_cap_ref c \<noteq> table_cap_ref capa) (a, b) s; obj_refs cap = obj_refs capa; is_pt_cap capa \<longrightarrow> (\<exists>y. cap_asid cap = Some y); is_pg_cap cap = is_pg_cap capa; is_pd_cap capa \<longrightarrow> (\<exists>y. cap_asid cap = Some y); is_pg_cap capa \<or> vs_cap_ref cap = vs_cap_ref capa; is_pt_cap cap = is_pt_cap capa; is_pd_cap cap = is_pd_cap capa; is_ep_cap cap = is_ep_cap capa; is_ntfn_cap cap = is_ntfn_cap capa; is_cnode_cap cap = is_cnode_cap capa; is_thread_cap cap = is_thread_cap capa; is_zombie cap = is_zombie capa; is_arch_cap cap = is_arch_cap capa; cap_is_device cap = cap_is_device capa; (a, b) \<noteq> dest; cte_wp_at (\<lambda>c. obj_refs c = obj_refs capa \<and> table_cap_ref c \<noteq> table_cap_ref cap) (a, b) s; table_cap_ref cap = table_cap_ref capa\<rbrakk> \<Longrightarrow> False
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 8. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (7 subgoals):
 1. \<And>s capa a b. \<lbrakk>caps_of_state s dest = Some NullCap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs capa \<and> table_cap_ref c \<noteq> table_cap_ref capa) (a, b) s; obj_refs cap = obj_refs capa; is_pt_cap capa \<longrightarrow> (\<exists>y. cap_asid cap = Some y); is_pg_cap cap = is_pg_cap capa; is_pd_cap capa \<longrightarrow> (\<exists>y. cap_asid cap = Some y); is_pg_cap capa \<or> vs_cap_ref cap = vs_cap_ref capa; is_pt_cap cap = is_pt_cap capa; is_pd_cap cap = is_pd_cap capa; is_ep_cap cap = is_ep_cap capa; is_ntfn_cap cap = is_ntfn_cap capa; is_cnode_cap cap = is_cnode_cap capa; is_thread_cap cap = is_thread_cap capa; is_zombie cap = is_zombie capa; is_arch_cap cap = is_arch_cap capa; cap_is_device cap = cap_is_device capa; (a, b) \<noteq> dest; cte_wp_at (\<lambda>c. obj_refs c = obj_refs capa \<and> table_cap_ref c \<noteq> table_cap_ref cap) (a, b) s; table_cap_ref cap = table_cap_ref capa\<rbrakk> \<Longrightarrow> False
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (7 subgoals):
 1. \<And>s capa a b. \<lbrakk>caps_of_state s dest = Some NullCap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); obj_refs cap = obj_refs capa; is_pt_cap capa \<longrightarrow> (\<exists>y. cap_asid cap = Some y); is_pg_cap cap = is_pg_cap capa; is_pd_cap capa \<longrightarrow> (\<exists>y. cap_asid cap = Some y); is_pg_cap capa \<or> vs_cap_ref cap = vs_cap_ref capa; is_pt_cap cap = is_pt_cap capa; is_pd_cap cap = is_pd_cap capa; is_ep_cap cap = is_ep_cap capa; is_ntfn_cap cap = is_ntfn_cap capa; is_cnode_cap cap = is_cnode_cap capa; is_thread_cap cap = is_thread_cap capa; is_zombie cap = is_zombie capa; is_arch_cap cap = is_arch_cap capa; cap_is_device cap = cap_is_device capa; (a, b) \<noteq> dest; cte_wp_at (\<lambda>c. obj_refs c = obj_refs capa \<and> table_cap_ref c \<noteq> table_cap_ref cap) (a, b) s; table_cap_ref cap = table_cap_ref capa; \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs capa \<and> table_cap_ref c \<noteq> table_cap_ref capa) (a, b) s\<rbrakk> \<Longrightarrow> False
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (6 subgoals):
 1. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) src s
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s p = Some ko \<and> empty_table (set (second_level_tables (arch_state s))) ko) \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (7 subgoals):
 1. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s\<rbrakk> \<Longrightarrow> is_pt_cap capa \<or> is_pd_cap capa
 2. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s\<rbrakk> \<Longrightarrow> cap_asid capa = None
 3. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s p = Some ko \<and> empty_table (set (second_level_tables (arch_state s))) ko) \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (7 subgoals):
 1. \<And>s capa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid)) capa; \<not> is_pd_cap capa\<rbrakk> \<Longrightarrow> is_pt_cap capa
 2. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s\<rbrakk> \<Longrightarrow> cap_asid capa = None
 3. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s p = Some ko \<and> empty_table (set (second_level_tables (arch_state s))) ko) \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (7 subgoals):
 1. \<And>s capa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<not> is_pd_cap capa; is_pt_cap (ArchObjectCap (PageTableCap p asid)) = is_pt_cap capa \<and> is_pd_cap (ArchObjectCap (PageTableCap p asid)) = is_pd_cap capa\<rbrakk> \<Longrightarrow> is_pt_cap capa
 2. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s\<rbrakk> \<Longrightarrow> cap_asid capa = None
 3. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s p = Some ko \<and> empty_table (set (second_level_tables (arch_state s))) ko) \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (6 subgoals):
 1. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s\<rbrakk> \<Longrightarrow> cap_asid capa = None
 2. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s p = Some ko \<and> empty_table (set (second_level_tables (arch_state s))) ko) \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (6 subgoals):
 1. \<And>s capa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid)) capa\<rbrakk> \<Longrightarrow> cap_asid capa = None
 2. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s p = Some ko \<and> empty_table (set (second_level_tables (arch_state s))) ko) \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (6 subgoals):
 1. \<And>s capa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid)) capa; (is_pt_cap (ArchObjectCap (PageTableCap p asid)) \<or> is_pd_cap (ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (ArchObjectCap (PageTableCap p asid)) \<noteq> None) \<and> (is_pg_cap (ArchObjectCap (PageTableCap p asid)) \<or> vs_cap_ref (ArchObjectCap (PageTableCap p asid)) = vs_cap_ref capa)\<rbrakk> \<Longrightarrow> cap_asid capa = None
 2. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s p = Some ko \<and> empty_table (set (second_level_tables (arch_state s))) ko) \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s capa capaa p asid. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid))) src s; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s p = Some ko \<and> empty_table (set (second_level_tables (arch_state s))) ko) \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s capa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid)) capa; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s p = Some ko \<and> empty_table (set (second_level_tables (arch_state s))) ko) \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s capa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid)) capa; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s; obj_refs (ArchObjectCap (PageTableCap p asid)) = obj_refs capa\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s p = Some ko \<and> empty_table (set (second_level_tables (arch_state s))) ko) \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (6 subgoals):
 1. \<And>s capa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid)) capa; obj_refs (ArchObjectCap (PageTableCap p asid)) = obj_refs capa\<rbrakk> \<Longrightarrow> p \<in> obj_refs capa
 2. \<And>s capa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid)) capa; obj_refs (ArchObjectCap (PageTableCap p asid)) = obj_refs capa; obj_at (empty_table (set (second_level_tables (arch_state s)))) p s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s p = Some ko \<and> empty_table (set (second_level_tables (arch_state s))) ko) \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 3. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s capa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; cap_asid (ArchObjectCap (PageTableCap p asid)) = None; cap = ArchObjectCap (PageTableCap p asid); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid)) capa; obj_refs (ArchObjectCap (PageTableCap p asid)) = obj_refs capa; obj_at (empty_table (set (second_level_tables (arch_state s)))) p s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s p = Some ko \<and> empty_table (set (second_level_tables (arch_state s))) ko) \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 2. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s capa capaa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<not> cap_asid cap \<noteq> None\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) x s \<and> (\<forall>ko. empty_table (set (second_level_tables (arch_state s))) ko \<longrightarrow> caps_of ko = {})
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s capa capaa x. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src cap) src s\<rbrakk> \<Longrightarrow> obj_at (empty_table (set (second_level_tables (arch_state s)))) x s
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (6 subgoals):
 1. \<And>s capa capaa x. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src cap) src s\<rbrakk> \<Longrightarrow> is_pt_cap capa \<or> is_pd_cap capa
 2. \<And>s capa capaa x. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src cap) src s\<rbrakk> \<Longrightarrow> cap_asid capa = None
 3. \<And>s capa capaa x. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src cap) src s; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> obj_at (empty_table (set (second_level_tables (arch_state s)))) x s
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 6. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s capa capaa x. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src cap) src s\<rbrakk> \<Longrightarrow> cap_asid capa = None
 2. \<And>s capa capaa x. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src cap) src s; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> obj_at (empty_table (set (second_level_tables (arch_state s)))) x s
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s capa x. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src cap capa\<rbrakk> \<Longrightarrow> cap_asid capa = None
 2. \<And>s capa capaa x. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src cap) src s; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> obj_at (empty_table (set (second_level_tables (arch_state s)))) x s
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s capa x. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src cap capa; (is_pt_cap cap \<or> is_pd_cap cap \<longrightarrow> cap_asid cap \<noteq> None) \<and> (is_pg_cap cap \<or> vs_cap_ref cap = vs_cap_ref capa)\<rbrakk> \<Longrightarrow> cap_asid capa = None
 2. \<And>s capa capaa x. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src cap) src s; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> obj_at (empty_table (set (second_level_tables (arch_state s)))) x s
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s capa capaa x. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cte_wp_at (is_derived (cdt s) src cap) src s; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> obj_at (empty_table (set (second_level_tables (arch_state s)))) x s
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s capa x. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src cap capa; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s\<rbrakk> \<Longrightarrow> obj_at (empty_table (set (second_level_tables (arch_state s)))) x s
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s capa x. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src cap capa; \<forall>r\<in>obj_refs capa. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s; obj_refs cap = obj_refs capa\<rbrakk> \<Longrightarrow> obj_at (empty_table (set (second_level_tables (arch_state s)))) x s
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s capa x. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src cap capa; obj_refs cap = obj_refs capa\<rbrakk> \<Longrightarrow> x \<in> obj_refs capa
 2. \<And>s capa x. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src cap capa; obj_refs cap = obj_refs capa; obj_at (empty_table (set (second_level_tables (arch_state s)))) x s\<rbrakk> \<Longrightarrow> obj_at (empty_table (set (second_level_tables (arch_state s)))) x s
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 5. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s capa x. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; is_pd_cap cap; cap_asid cap = None; x \<in> obj_refs cap; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); is_derived (cdt s) src cap capa; obj_refs cap = obj_refs capa; obj_at (empty_table (set (second_level_tables (arch_state s)))) x s\<rbrakk> \<Longrightarrow> obj_at (empty_table (set (second_level_tables (arch_state s)))) x s
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 3. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 4. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>caps_of_state s_ src = Some capa_; caps_of_state s_ dest = Some NullCap; is_pd_cap cap; cap_asid cap = None; x_ \<in> obj_refs cap; valid_vs_lookup s_; valid_table_caps s_; unique_table_caps (caps_of_state s_); unique_table_refs (caps_of_state s_); is_derived (cdt s_) src cap capa_; obj_refs cap = obj_refs capa_; obj_at (empty_table (set (second_level_tables (arch_state s_)))) x_ s_\<rbrakk> \<Longrightarrow> obj_at (empty_table (set (second_level_tables (arch_state s_)))) x_ s_ proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pt_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap cap \<and> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap a \<or> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap (masked_as_full a cap) \<or> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 3. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s capa x xa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; dest = src \<longrightarrow> (\<forall>p asid. capa \<noteq> ArchObjectCap (PageTableCap p asid)) \<or> cap_asid (ArchObjectCap (PageTableCap p asid)) = None \<and> (\<exists>y. cap_asid capa = Some y) \<or> obj_refs capa \<noteq> {p}; cap = ArchObjectCap (PageTableCap p asid); valid_arch_caps s; is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid)) capa; (x, xa) = src \<or> (\<exists>cap. obj_refs cap = {p} \<and> caps_of_state s (x, xa) = Some cap \<and> (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (cap_asid (ArchObjectCap (PageTableCap p asid)) = None \<or> cap_asid cap = None)); (x, xa) = src \<longrightarrow> obj_refs capa = {p} \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<and> (cap_asid (ArchObjectCap (PageTableCap p asid)) = None \<or> cap_asid capa = None)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 3. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s capa x xa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; dest = src \<longrightarrow> (\<forall>p asid. capa \<noteq> ArchObjectCap (PageTableCap p asid)) \<or> cap_asid (ArchObjectCap (PageTableCap p asid)) = None \<and> (\<exists>y. cap_asid capa = Some y) \<or> obj_refs capa \<noteq> {p}; cap = ArchObjectCap (PageTableCap p asid); valid_arch_caps s; is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid)) capa; (x, xa) = src \<or> (\<exists>cap. obj_refs cap = {p} \<and> caps_of_state s (x, xa) = Some cap \<and> (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (cap_asid (ArchObjectCap (PageTableCap p asid)) = None \<or> cap_asid cap = None)); (x, xa) = src \<longrightarrow> obj_refs capa = {p} \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<and> (cap_asid (ArchObjectCap (PageTableCap p asid)) = None \<or> cap_asid capa = None); is_pt_cap (ArchObjectCap (PageTableCap p asid)) = is_pt_cap capa \<and> is_pd_cap (ArchObjectCap (PageTableCap p asid)) = is_pd_cap capa\<rbrakk> \<Longrightarrow> (x, xa) = dest
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 3. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s capa x xa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; dest = src \<longrightarrow> (\<forall>p asid. capa \<noteq> ArchObjectCap (PageTableCap p asid)) \<or> cap_asid (ArchObjectCap (PageTableCap p asid)) = None \<and> (\<exists>y. cap_asid capa = Some y) \<or> obj_refs capa \<noteq> {p}; cap = ArchObjectCap (PageTableCap p asid); valid_arch_caps s; is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid)) capa; (x, xa) = src \<or> (\<exists>cap. obj_refs cap = {p} \<and> caps_of_state s (x, xa) = Some cap \<and> (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (cap_asid (ArchObjectCap (PageTableCap p asid)) = None \<or> cap_asid cap = None)); (x, xa) = src \<longrightarrow> obj_refs capa = {p} \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<and> (cap_asid (ArchObjectCap (PageTableCap p asid)) = None \<or> cap_asid capa = None); is_pt_cap (ArchObjectCap (PageTableCap p asid)) = is_pt_cap capa \<and> is_pd_cap (ArchObjectCap (PageTableCap p asid)) = is_pd_cap capa; obj_refs (ArchObjectCap (PageTableCap p asid)) = obj_refs capa\<rbrakk> \<Longrightarrow> (x, xa) = dest
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 3. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s capa x xa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; dest = src \<longrightarrow> (\<forall>p asid. capa \<noteq> ArchObjectCap (PageTableCap p asid)) \<or> cap_asid (ArchObjectCap (PageTableCap p asid)) = None \<and> (\<exists>y. cap_asid capa = Some y) \<or> obj_refs capa \<noteq> {p}; cap = ArchObjectCap (PageTableCap p asid); valid_arch_caps s; is_derived (cdt s) src (ArchObjectCap (PageTableCap p asid)) capa; (x, xa) = src \<or> (\<exists>cap. obj_refs cap = {p} \<and> caps_of_state s (x, xa) = Some cap \<and> (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (cap_asid (ArchObjectCap (PageTableCap p asid)) = None \<or> cap_asid cap = None)); (x, xa) = src \<longrightarrow> obj_refs capa = {p} \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<and> (cap_asid (ArchObjectCap (PageTableCap p asid)) = None \<or> cap_asid capa = None); is_pt_cap (ArchObjectCap (PageTableCap p asid)) = is_pt_cap capa \<and> is_pd_cap (ArchObjectCap (PageTableCap p asid)) = is_pd_cap capa; obj_refs (ArchObjectCap (PageTableCap p asid)) = obj_refs capa; (is_pt_cap (ArchObjectCap (PageTableCap p asid)) \<or> is_pd_cap (ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (ArchObjectCap (PageTableCap p asid)) \<noteq> None) \<and> (is_pg_cap (ArchObjectCap (PageTableCap p asid)) \<or> vs_cap_ref (ArchObjectCap (PageTableCap p asid)) = vs_cap_ref capa)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 3. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageTableCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageTableCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageTableCap pa asid)) = vs_cap_ref (ArchObjectCap (PageTableCap pa asida)); cap_asid (ArchObjectCap (PageTableCap pa asida)) = Some y; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageTableCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageTableCap pa asidb)); cap_asid (ArchObjectCap (PageTableCap pa asidb)) = None\<rbrakk> \<Longrightarrow> (x, xa) = dest
 2. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 3. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (8 subgoals):
 1. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageTableCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageTableCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageTableCap pa asid)) = vs_cap_ref (ArchObjectCap (PageTableCap pa asida)); cap_asid (ArchObjectCap (PageTableCap pa asida)) = Some y; valid_table_caps s; unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageTableCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageTableCap pa asidb)); cap_asid (ArchObjectCap (PageTableCap pa asidb)) = None\<rbrakk> \<Longrightarrow> caps_of_state s src = Some (?cap443 s x xa asid pa asida y asidb)
 2. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageTableCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageTableCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageTableCap pa asid)) = vs_cap_ref (ArchObjectCap (PageTableCap pa asida)); cap_asid (ArchObjectCap (PageTableCap pa asida)) = Some y; valid_table_caps s; unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageTableCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageTableCap pa asidb)); cap_asid (ArchObjectCap (PageTableCap pa asidb)) = None\<rbrakk> \<Longrightarrow> caps_of_state s (x, xa) = Some (?cap'443 s x xa asid pa asida y asidb)
 3. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageTableCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageTableCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageTableCap pa asid)) = vs_cap_ref (ArchObjectCap (PageTableCap pa asida)); cap_asid (ArchObjectCap (PageTableCap pa asida)) = Some y; valid_table_caps s; unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageTableCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageTableCap pa asidb)); cap_asid (ArchObjectCap (PageTableCap pa asidb)) = None\<rbrakk> \<Longrightarrow> obj_refs (?cap443 s x xa asid pa asida y asidb) = obj_refs (?cap'443 s x xa asid pa asida y asidb)
 4. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageTableCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageTableCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageTableCap pa asid)) = vs_cap_ref (ArchObjectCap (PageTableCap pa asida)); cap_asid (ArchObjectCap (PageTableCap pa asida)) = Some y; valid_table_caps s; unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageTableCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageTableCap pa asidb)); cap_asid (ArchObjectCap (PageTableCap pa asidb)) = None\<rbrakk> \<Longrightarrow> cap_asid (?cap443 s x xa asid pa asida y asidb) = None \<or> cap_asid (?cap'443 s x xa asid pa asida y asidb) = None
 5. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageTableCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageTableCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageTableCap pa asid)) = vs_cap_ref (ArchObjectCap (PageTableCap pa asida)); cap_asid (ArchObjectCap (PageTableCap pa asida)) = Some y; valid_table_caps s; unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageTableCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageTableCap pa asidb)); cap_asid (ArchObjectCap (PageTableCap pa asidb)) = None\<rbrakk> \<Longrightarrow> is_pd_cap (?cap443 s x xa asid pa asida y asidb) \<and> is_pd_cap (?cap'443 s x xa asid pa asida y asidb) \<or> is_pt_cap (?cap443 s x xa asid pa asida y asidb) \<and> is_pt_cap (?cap'443 s x xa asid pa asida y asidb)
 6. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageTableCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageTableCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageTableCap pa asid)) = vs_cap_ref (ArchObjectCap (PageTableCap pa asida)); cap_asid (ArchObjectCap (PageTableCap pa asida)) = Some y; valid_table_caps s; unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageTableCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageTableCap pa asidb)); cap_asid (ArchObjectCap (PageTableCap pa asidb)) = None; src = (x, xa)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa. \<lbrakk>(valid_arch_caps and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)) s; cte_wp_at ((=) capa) src s; \<not> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cap \<noteq> NullCap); cte_wp_at ((=) capaa) dest s; \<not> \<not> is_pd_cap cap; \<nexists>x. (dest \<noteq> src \<and> cte_wp_at ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s \<or> dest = src \<and> cte_wp_at (\<lambda>a. ((=) x and (\<lambda>a. is_pt_cap cap \<and> is_pt_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> is_pd_cap a \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) (masked_as_full a cap)) src s) \<and> cte_wp_at ((=) capa) src s; \<not> (((x, xa) \<noteq> src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> (is_pd_cap a \<or> is_pt_cap cap \<and> is_pt_cap a) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s \<or> (x, xa) = src \<and> \<not> cte_wp_at (\<lambda>a. obj_refs (masked_as_full a cap) = obj_refs cap \<and> (is_pd_cap (masked_as_full a cap) \<or> is_pt_cap cap \<and> is_pt_cap (masked_as_full a cap)) \<and> (cap_asid cap = None \<or> cap_asid (masked_as_full a cap) = None)) src s) \<and> cte_wp_at ((=) capa) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 8. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa x xa. \<lbrakk>valid_arch_caps s \<and> cte_wp_at (is_derived (cdt s) src cap) src s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; \<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid); \<forall>x. (dest = src \<or> \<not> cte_wp_at (\<lambda>a. x = a \<and> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. a = ArchObjectCap (PageTableCap p asid)) \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> (\<exists>p asid. a = ArchObjectCap (PageDirectoryCap p asid)) \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) dest s) \<and> (dest = src \<longrightarrow> \<not> cte_wp_at (\<lambda>a. x = masked_as_full a cap \<and> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. masked_as_full a cap = ArchObjectCap (PageTableCap p asid)) \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap \<or> (\<exists>p asid. masked_as_full a cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (cap_asid cap = None \<longrightarrow> cap_asid a = None) \<and> obj_refs a = obj_refs cap)) src s); ((x, xa) = src \<or> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> ((\<exists>p asid. a = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. a = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid a = None)) (x, xa) s) \<and> ((x, xa) = src \<longrightarrow> cte_wp_at (\<lambda>a. obj_refs a = obj_refs cap \<and> ((\<exists>p asid. masked_as_full a cap = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. masked_as_full a cap = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid a = None)) src s)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 2. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s capa x xa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; dest = src \<longrightarrow> (\<forall>p asid. capa \<noteq> ArchObjectCap (PageDirectoryCap p asid)) \<or> cap_asid (ArchObjectCap (PageDirectoryCap p asid)) = None \<and> (\<exists>y. cap_asid capa = Some y) \<or> obj_refs capa \<noteq> {p}; cap = ArchObjectCap (PageDirectoryCap p asid); valid_arch_caps s; is_derived (cdt s) src (ArchObjectCap (PageDirectoryCap p asid)) capa; (x, xa) = src \<or> (\<exists>cap. caps_of_state s (x, xa) = Some cap \<and> obj_refs cap = {p} \<and> (\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (cap_asid (ArchObjectCap (PageDirectoryCap p asid)) = None \<or> cap_asid cap = None)); (x, xa) = src \<longrightarrow> obj_refs capa = {p} \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<and> (cap_asid (ArchObjectCap (PageDirectoryCap p asid)) = None \<or> cap_asid capa = None)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 2. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s capa x xa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; dest = src \<longrightarrow> (\<forall>p asid. capa \<noteq> ArchObjectCap (PageDirectoryCap p asid)) \<or> cap_asid (ArchObjectCap (PageDirectoryCap p asid)) = None \<and> (\<exists>y. cap_asid capa = Some y) \<or> obj_refs capa \<noteq> {p}; cap = ArchObjectCap (PageDirectoryCap p asid); valid_arch_caps s; is_derived (cdt s) src (ArchObjectCap (PageDirectoryCap p asid)) capa; (x, xa) = src \<or> (\<exists>cap. caps_of_state s (x, xa) = Some cap \<and> obj_refs cap = {p} \<and> (\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (cap_asid (ArchObjectCap (PageDirectoryCap p asid)) = None \<or> cap_asid cap = None)); (x, xa) = src \<longrightarrow> obj_refs capa = {p} \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<and> (cap_asid (ArchObjectCap (PageDirectoryCap p asid)) = None \<or> cap_asid capa = None); is_pt_cap (ArchObjectCap (PageDirectoryCap p asid)) = is_pt_cap capa \<and> is_pd_cap (ArchObjectCap (PageDirectoryCap p asid)) = is_pd_cap capa\<rbrakk> \<Longrightarrow> (x, xa) = dest
 2. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s capa x xa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; dest = src \<longrightarrow> (\<forall>p asid. capa \<noteq> ArchObjectCap (PageDirectoryCap p asid)) \<or> cap_asid (ArchObjectCap (PageDirectoryCap p asid)) = None \<and> (\<exists>y. cap_asid capa = Some y) \<or> obj_refs capa \<noteq> {p}; cap = ArchObjectCap (PageDirectoryCap p asid); valid_arch_caps s; is_derived (cdt s) src (ArchObjectCap (PageDirectoryCap p asid)) capa; (x, xa) = src \<or> (\<exists>cap. caps_of_state s (x, xa) = Some cap \<and> obj_refs cap = {p} \<and> (\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (cap_asid (ArchObjectCap (PageDirectoryCap p asid)) = None \<or> cap_asid cap = None)); (x, xa) = src \<longrightarrow> obj_refs capa = {p} \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<and> (cap_asid (ArchObjectCap (PageDirectoryCap p asid)) = None \<or> cap_asid capa = None); is_pt_cap (ArchObjectCap (PageDirectoryCap p asid)) = is_pt_cap capa \<and> is_pd_cap (ArchObjectCap (PageDirectoryCap p asid)) = is_pd_cap capa; obj_refs (ArchObjectCap (PageDirectoryCap p asid)) = obj_refs capa\<rbrakk> \<Longrightarrow> (x, xa) = dest
 2. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s capa x xa p asid. \<lbrakk>caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; dest = src \<longrightarrow> (\<forall>p asid. capa \<noteq> ArchObjectCap (PageDirectoryCap p asid)) \<or> cap_asid (ArchObjectCap (PageDirectoryCap p asid)) = None \<and> (\<exists>y. cap_asid capa = Some y) \<or> obj_refs capa \<noteq> {p}; cap = ArchObjectCap (PageDirectoryCap p asid); valid_arch_caps s; is_derived (cdt s) src (ArchObjectCap (PageDirectoryCap p asid)) capa; (x, xa) = src \<or> (\<exists>cap. caps_of_state s (x, xa) = Some cap \<and> obj_refs cap = {p} \<and> (\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (cap_asid (ArchObjectCap (PageDirectoryCap p asid)) = None \<or> cap_asid cap = None)); (x, xa) = src \<longrightarrow> obj_refs capa = {p} \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<and> (cap_asid (ArchObjectCap (PageDirectoryCap p asid)) = None \<or> cap_asid capa = None); is_pt_cap (ArchObjectCap (PageDirectoryCap p asid)) = is_pt_cap capa \<and> is_pd_cap (ArchObjectCap (PageDirectoryCap p asid)) = is_pd_cap capa; obj_refs (ArchObjectCap (PageDirectoryCap p asid)) = obj_refs capa; (is_pt_cap (ArchObjectCap (PageDirectoryCap p asid)) \<or> is_pd_cap (ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (ArchObjectCap (PageDirectoryCap p asid)) \<noteq> None) \<and> (is_pg_cap (ArchObjectCap (PageDirectoryCap p asid)) \<or> vs_cap_ref (ArchObjectCap (PageDirectoryCap p asid)) = vs_cap_ref capa)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 2. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageDirectoryCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageDirectoryCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asid)) = vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asida)); cap_asid (ArchObjectCap (PageDirectoryCap pa asida)) = Some y; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageDirectoryCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageDirectoryCap pa asidb)); cap_asid (ArchObjectCap (PageDirectoryCap pa asidb)) = None\<rbrakk> \<Longrightarrow> (x, xa) = dest
 2. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (7 subgoals):
 1. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageDirectoryCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageDirectoryCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asid)) = vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asida)); cap_asid (ArchObjectCap (PageDirectoryCap pa asida)) = Some y; valid_table_caps s; unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageDirectoryCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageDirectoryCap pa asidb)); cap_asid (ArchObjectCap (PageDirectoryCap pa asidb)) = None\<rbrakk> \<Longrightarrow> caps_of_state s src = Some (?cap486 s x xa asid pa asida y asidb)
 2. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageDirectoryCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageDirectoryCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asid)) = vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asida)); cap_asid (ArchObjectCap (PageDirectoryCap pa asida)) = Some y; valid_table_caps s; unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageDirectoryCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageDirectoryCap pa asidb)); cap_asid (ArchObjectCap (PageDirectoryCap pa asidb)) = None\<rbrakk> \<Longrightarrow> caps_of_state s (x, xa) = Some (?cap'486 s x xa asid pa asida y asidb)
 3. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageDirectoryCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageDirectoryCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asid)) = vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asida)); cap_asid (ArchObjectCap (PageDirectoryCap pa asida)) = Some y; valid_table_caps s; unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageDirectoryCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageDirectoryCap pa asidb)); cap_asid (ArchObjectCap (PageDirectoryCap pa asidb)) = None\<rbrakk> \<Longrightarrow> obj_refs (?cap486 s x xa asid pa asida y asidb) = obj_refs (?cap'486 s x xa asid pa asida y asidb)
 4. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageDirectoryCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageDirectoryCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asid)) = vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asida)); cap_asid (ArchObjectCap (PageDirectoryCap pa asida)) = Some y; valid_table_caps s; unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageDirectoryCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageDirectoryCap pa asidb)); cap_asid (ArchObjectCap (PageDirectoryCap pa asidb)) = None\<rbrakk> \<Longrightarrow> cap_asid (?cap486 s x xa asid pa asida y asidb) = None \<or> cap_asid (?cap'486 s x xa asid pa asida y asidb) = None
 5. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageDirectoryCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageDirectoryCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asid)) = vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asida)); cap_asid (ArchObjectCap (PageDirectoryCap pa asida)) = Some y; valid_table_caps s; unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageDirectoryCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageDirectoryCap pa asidb)); cap_asid (ArchObjectCap (PageDirectoryCap pa asidb)) = None\<rbrakk> \<Longrightarrow> is_pd_cap (?cap486 s x xa asid pa asida y asidb) \<and> is_pd_cap (?cap'486 s x xa asid pa asida y asidb) \<or> is_pt_cap (?cap486 s x xa asid pa asida y asidb) \<and> is_pt_cap (?cap'486 s x xa asid pa asida y asidb)
 6. \<And>s x xa asid pa asida y asidb. \<lbrakk>caps_of_state s src = Some (ArchObjectCap (PageDirectoryCap pa asida)); caps_of_state s dest = Some NullCap; dest \<noteq> src; cap = ArchObjectCap (PageDirectoryCap pa asid); (x, xa) \<noteq> src; valid_vs_lookup s; vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asid)) = vs_cap_ref (ArchObjectCap (PageDirectoryCap pa asida)); cap_asid (ArchObjectCap (PageDirectoryCap pa asida)) = Some y; valid_table_caps s; unique_table_refs (caps_of_state s); cap_asid (ArchObjectCap (PageDirectoryCap pa asid)) = Some y; caps_of_state s (x, xa) = Some (ArchObjectCap (PageDirectoryCap pa asidb)); cap_asid (ArchObjectCap (PageDirectoryCap pa asidb)) = None; src = (x, xa)\<rbrakk> \<Longrightarrow> (x, xa) = dest
 7. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s capa capaa x xa xb. \<lbrakk>cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; cte_wp_at ((=) capaa) dest s; vs_cap_ref xa = Some x; vs_cap_ref cap = Some x \<longrightarrow> obj_refs cap \<noteq> obj_refs xa; is_final_cap' xa s \<or> reachable_pg_cap xa s; xb \<in> obj_refs xa; valid_arch_caps s; cte_wp_at (is_derived (cdt s) src cap) src s; dest = src \<or> cte_wp_at ((=) xa) dest s; dest = src \<longrightarrow> cte_wp_at (\<lambda>a. xa = masked_as_full a cap) src s; (x \<unrhd> xb) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals!