theory CSpace_AI

lemma cap_move_mdb [wp]:
  fixes dest cap src
  shows
  "\<lbrace>valid_mdb and cte_wp_at ((=) cap.NullCap) dest and
    cte_wp_at (\<lambda>c. weak_derived cap c \<and> c \<noteq> cap.NullCap) src\<rbrace>
  cap_move cap src dest
  \<lbrace>\<lambda>_. valid_mdb :: 'state_ext state \<Rightarrow> bool\<rbrace>" apply (simp add: cap_move_def set_cdt_def valid_mdb_def2
                   pred_conj_def cte_wp_at_caps_of_state) apply (wp update_cdt_cdt | simp split del: if_split)+ apply (rule hoare_lift_Pf3[where f="is_original_cap"]) apply (wp set_cap_caps_of_state2 | simp split del: if_split)+ apply (clarsimp simp: mdb_cte_at_def fun_upd_def[symmetric]
              simp del: fun_upd_apply) apply (rule conjI) apply (cases src, cases dest) apply (subgoal_tac "cap.NullCap \<noteq> cap") apply (intro allI conjI) apply fastforce apply (clarsimp split del: if_split) apply (rule conjI) apply fastforce apply clarsimp apply fastforce apply (subgoal_tac "mdb_move_abs src dest (cdt s) s") prefer 2 apply (rule mdb_move_abs.intro) apply (simp add: valid_mdb_def swp_def cte_wp_at_caps_of_state
                       mdb_cte_at_def) apply (simp add: cte_wp_at_caps_of_state) apply (rule refl) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (frule mdb_move_abs_gen) apply (rule conjI) apply (simp add: untyped_mdb_def mdb_move_abs.descendants) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (rule conjI) apply clarsimp apply (rule conjI, clarsimp simp: is_cap_simps) apply (clarsimp simp: descendants_of_def) apply (drule tranclD) apply (clarsimp simp: cdt_parent_of_def mdb_cte_at_def) apply fastforce apply clarsimp apply (rule conjI) apply clarsimp apply (rule conjI, clarsimp simp: is_cap_simps) apply clarsimp apply (drule (1) weak_derived_untyped2) apply (cases src) apply clarsimp apply clarsimp apply (drule weak_derived_obj_refs) apply clarsimp apply (cases src) apply clarsimp apply (rule conjI) apply (erule(4) mdb_move_abs_gen.descendants_inc) apply (rule conjI) apply (simp add: no_mloop_def mdb_move_abs.parency) apply (simp add: mdb_move_abs.desc_dest [unfolded descendants_of_def, simplified]) apply (rule conjI) apply (erule (4) mdb_move_abs_gen.untyped_inc) apply (rule conjI) apply (simp add: ut_revocable_def weak_derived_is_untyped del: split_paired_All) apply (rule conjI) apply (simp add: irq_revocable_def del: split_paired_All) apply clarsimp apply (metis surj_pair) apply (rule conjI) apply (simp add: reply_master_revocable_def del: split_paired_All) apply (drule_tac x=src in spec, drule_tac x=capa in spec) apply (intro impI) apply (simp add: weak_derived_is_reply_master) apply (rule conjI, erule (4) mdb_move_abs.reply_mdb) apply (erule (2) valid_arch_mdb_updates) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_mdb and cte_wp_at ((=) NullCap) dest and cte_wp_at (\<lambda>c. weak_derived cap c \<and> c \<noteq> NullCap) src\<rbrace> cap_move cap src dest \<lbrace>\<lambda>_. valid_mdb\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>x. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state x p = Some c \<and> NullCap \<noteq> c) (cdt x) \<and> untyped_mdb (cdt x) (caps_of_state x) \<and> descendants_inc (cdt x) (caps_of_state x) \<and> no_mloop (cdt x) \<and> untyped_inc (cdt x) (caps_of_state x) \<and> ut_revocable (is_original_cap x) (caps_of_state x) \<and> irq_revocable (is_original_cap x) (caps_of_state x) \<and> reply_master_revocable (is_original_cap x) (caps_of_state x) \<and> reply_mdb (cdt x) (caps_of_state x) \<and> valid_arch_mdb (is_original_cap x) (caps_of_state x) \<and> caps_of_state x dest = Some NullCap \<and> (\<exists>capa. caps_of_state x src = Some capa \<and> weak_derived cap capa \<and> capa \<noteq> NullCap)\<rbrace> do y <- set_cap cap dest;
y <- set_cap NullCap src;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
cdt <- gets cdt;
y <- do s <- get;
put (s\<lparr>cdt := \<lambda>r. if (if r = src then None else (cdt(dest := cdt src)) r) = Some src then Some dest else (cdt(dest := cdt src, src := None)) r\<rparr>)
od;
y <- do_extended_op (cap_move_ext src dest src_p dest_p);
is_original <- gets is_original_cap;
y <- set_original dest (is_original src);
set_original src False
od \<lbrace>\<lambda>_ s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<lbrace>?B3 ()\<rbrace> set_cap NullCap src \<lbrace>\<lambda>ya s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) (caps_of_state s) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) (caps_of_state s) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) (caps_of_state s) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) (caps_of_state s) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) (caps_of_state s) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) (caps_of_state s) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) (caps_of_state s) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) (caps_of_state s)\<rbrace>
 2. \<lbrace>?Q2\<rbrace> set_cap cap dest \<lbrace>?B3\<rbrace>
 3. \<And>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> caps_of_state s dest = Some NullCap \<and> (\<exists>capa. caps_of_state s src = Some capa \<and> weak_derived cap capa \<and> capa \<noteq> NullCap) \<Longrightarrow> ?Q2 s proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrace>?Q35 x\<rbrace> set_cap NullCap src \<lbrace>\<lambda>a b. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state b p = Some c \<and> NullCap \<noteq> c) (\<lambda>r. if (if r = src then None else ((cdt b)(dest := cdt b src)) r) = Some src then Some dest else ((cdt b)(dest := cdt b src, src := None)) r) \<and> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt b)(dest := cdt b src)) r) = Some src then Some dest else ((cdt b)(dest := cdt b src, src := None)) r) (caps_of_state b) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt b)(dest := cdt b src)) r) = Some src then Some dest else ((cdt b)(dest := cdt b src, src := None)) r) (caps_of_state b) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt b)(dest := cdt b src)) r) = Some src then Some dest else ((cdt b)(dest := cdt b src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt b)(dest := cdt b src)) r) = Some src then Some dest else ((cdt b)(dest := cdt b src, src := None)) r) (caps_of_state b) \<and> ut_revocable (x(dest := x src, src := False)) (caps_of_state b) \<and> irq_revocable (x(dest := x src, src := False)) (caps_of_state b) \<and> reply_master_revocable (x(dest := x src, src := False)) (caps_of_state b) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt b)(dest := cdt b src)) r) = Some src then Some dest else ((cdt b)(dest := cdt b src, src := None)) r) (caps_of_state b) \<and> valid_arch_mdb (x(dest := x src, src := False)) (caps_of_state b)\<rbrace>
 2. \<And>P. \<lbrace>\<lambda>s. P (is_original_cap s)\<rbrace> set_cap NullCap src \<lbrace>\<lambda>_ s. P (is_original_cap s)\<rbrace>
 3. \<lbrace>?Q2\<rbrace> set_cap cap dest \<lbrace>?B3\<rbrace>
 4. \<And>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> caps_of_state s dest = Some NullCap \<and> (\<exists>capa. caps_of_state s src = Some capa \<and> weak_derived cap capa \<and> capa \<noteq> NullCap) \<Longrightarrow> ?Q2 s
flex-flex pairs:
\<lambda>s. ?Q35 (is_original_cap s) s \<equiv>\<^sup>? ?B3 () proof (prove)
goal (1 subgoal):
 1. \<And>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> caps_of_state s dest = Some NullCap \<and> (\<exists>capa. caps_of_state s src = Some capa \<and> weak_derived cap capa \<and> capa \<noteq> NullCap) \<Longrightarrow> mdb_cte_at (\<lambda>p. \<exists>c. (if p = src then Some NullCap else if p = dest then Some cap else caps_of_state s p) = Some c \<and> NullCap \<noteq> c) (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) (\<lambda>a. if a = src then Some NullCap else if a = dest then Some cap else caps_of_state s a) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) (\<lambda>a. if a = src then Some NullCap else if a = dest then Some cap else caps_of_state s a) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) (\<lambda>a. if a = src then Some NullCap else if a = dest then Some cap else caps_of_state s a) \<and> ut_revocable (\<lambda>a. if a = src then False else if a = dest then is_original_cap s src else is_original_cap s a) (\<lambda>a. if a = src then Some NullCap else if a = dest then Some cap else caps_of_state s a) \<and> irq_revocable (\<lambda>a. if a = src then False else if a = dest then is_original_cap s src else is_original_cap s a) (\<lambda>a. if a = src then Some NullCap else if a = dest then Some cap else caps_of_state s a) \<and> reply_master_revocable (\<lambda>a. if a = src then False else if a = dest then is_original_cap s src else is_original_cap s a) (\<lambda>a. if a = src then Some NullCap else if a = dest then Some cap else caps_of_state s a) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) (\<lambda>a. if a = src then Some NullCap else if a = dest then Some cap else caps_of_state s a) \<and> valid_arch_mdb (\<lambda>a. if a = src then False else if a = dest then is_original_cap s src else is_original_cap s a) (\<lambda>a. if a = src then Some NullCap else if a = dest then Some cap else caps_of_state s a) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> (dest = src \<longrightarrow> (\<forall>a b. ((a, b) = src \<longrightarrow> ((cdt s)(src := None)) src \<noteq> Some src) \<and> ((a, b) \<noteq> src \<longrightarrow> cdt s (a, b) \<noteq> Some src \<and> (cdt s (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(src := None)) (a, b) \<noteq> Some src)))) \<and> (dest \<noteq> src \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> (((cdt s)(dest := cdt s src)) dest = Some src \<longrightarrow> NullCap \<noteq> cap) \<and> (((cdt s)(dest := cdt s src)) dest \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) dest = Some dest \<longrightarrow> NullCap \<noteq> cap)) \<and> ((a, b) \<noteq> dest \<longrightarrow> ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some dest) \<and> ((a, b) \<noteq> src \<longrightarrow> (((cdt s)(dest := cdt s src)) (a, b) = Some src \<longrightarrow> NullCap \<noteq> cap \<and> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c)) \<and> (((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) = Some dest \<longrightarrow> NullCap \<noteq> cap \<and> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c))))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> ((a, b) = src \<longrightarrow> (\<forall>a b. ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some src) \<and> ((a, b) \<noteq> src \<longrightarrow> (((cdt s)(dest := cdt s src)) (a, b) = Some src \<longrightarrow> dest \<noteq> src) \<and> (((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) \<noteq> Some src)))) \<and> ((a, b) \<noteq> src \<longrightarrow> (\<forall>aa ba. ((aa, ba) = dest \<longrightarrow> (dest = src \<longrightarrow> ((cdt s)(src := None)) src \<noteq> Some (a, b)) \<and> (dest \<noteq> src \<longrightarrow> ((cdt s)(dest := cdt s src)) dest \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) dest = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> NullCap \<noteq> cap)) \<and> ((aa, ba) \<noteq> dest \<longrightarrow> ((aa, ba) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some (a, b)) \<and> ((aa, ba) \<noteq> src \<longrightarrow> ((cdt s)(dest := cdt s src)) (aa, ba) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c))))))) \<and> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<forall>a b. ((a, b) = dest \<longrightarrow> (dest = src \<longrightarrow> (\<forall>a b. ((a, b) = src \<longrightarrow> ((cdt s)(src := None)) src \<noteq> Some src) \<and> ((a, b) \<noteq> src \<longrightarrow> cdt s (a, b) \<noteq> Some src \<and> (cdt s (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(src := None)) (a, b) \<noteq> Some src)))) \<and> (dest \<noteq> src \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> (((cdt s)(dest := cdt s src)) dest = Some src \<longrightarrow> NullCap \<noteq> cap) \<and> (((cdt s)(dest := cdt s src)) dest \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) dest = Some dest \<longrightarrow> NullCap \<noteq> cap)) \<and> ((a, b) \<noteq> dest \<longrightarrow> ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some dest) \<and> ((a, b) \<noteq> src \<longrightarrow> (((cdt s)(dest := cdt s src)) (a, b) = Some src \<longrightarrow> NullCap \<noteq> cap \<and> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c)) \<and> (((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) = Some dest \<longrightarrow> NullCap \<noteq> cap \<and> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c))))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> ((a, b) = src \<longrightarrow> (\<forall>a b. ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some src) \<and> ((a, b) \<noteq> src \<longrightarrow> (((cdt s)(dest := cdt s src)) (a, b) = Some src \<longrightarrow> dest \<noteq> src) \<and> (((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) \<noteq> Some src)))) \<and> ((a, b) \<noteq> src \<longrightarrow> (\<forall>aa ba. ((aa, ba) = dest \<longrightarrow> (dest = src \<longrightarrow> ((cdt s)(src := None)) src \<noteq> Some (a, b)) \<and> (dest \<noteq> src \<longrightarrow> ((cdt s)(dest := cdt s src)) dest \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) dest = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> NullCap \<noteq> cap)) \<and> ((aa, ba) \<noteq> dest \<longrightarrow> ((aa, ba) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some (a, b)) \<and> ((aa, ba) \<noteq> src \<longrightarrow> ((cdt s)(dest := cdt s src)) (aa, ba) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c))))))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba)\<rbrakk> \<Longrightarrow> \<forall>a b. ((a, b) = dest \<longrightarrow> (dest = src \<longrightarrow> (\<forall>a b. ((a, b) = src \<longrightarrow> ((cdt s)(src := None)) src \<noteq> Some src) \<and> ((a, b) \<noteq> src \<longrightarrow> cdt s (a, b) \<noteq> Some src \<and> (cdt s (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(src := None)) (a, b) \<noteq> Some src)))) \<and> (dest \<noteq> src \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> (((cdt s)(dest := cdt s src)) dest = Some src \<longrightarrow> NullCap \<noteq> cap) \<and> (((cdt s)(dest := cdt s src)) dest \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) dest = Some dest \<longrightarrow> NullCap \<noteq> cap)) \<and> ((a, b) \<noteq> dest \<longrightarrow> ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some dest) \<and> ((a, b) \<noteq> src \<longrightarrow> (((cdt s)(dest := cdt s src)) (a, b) = Some src \<longrightarrow> NullCap \<noteq> cap \<and> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c)) \<and> (((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) = Some dest \<longrightarrow> NullCap \<noteq> cap \<and> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c))))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> ((a, b) = src \<longrightarrow> (\<forall>a b. ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some src) \<and> ((a, b) \<noteq> src \<longrightarrow> (((cdt s)(dest := cdt s src)) (a, b) = Some src \<longrightarrow> dest \<noteq> src) \<and> (((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) \<noteq> Some src)))) \<and> ((a, b) \<noteq> src \<longrightarrow> (\<forall>aa ba. ((aa, ba) = dest \<longrightarrow> (dest = src \<longrightarrow> ((cdt s)(src := None)) src \<noteq> Some (a, b)) \<and> (dest \<noteq> src \<longrightarrow> ((cdt s)(dest := cdt s src)) dest \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) dest = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> NullCap \<noteq> cap)) \<and> ((aa, ba) \<noteq> dest \<longrightarrow> ((aa, ba) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some (a, b)) \<and> ((aa, ba) \<noteq> src \<longrightarrow> ((cdt s)(dest := cdt s src)) (aa, ba) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c))))))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba); NullCap \<noteq> cap\<rbrakk> \<Longrightarrow> \<forall>a b. ((a, b) = dest \<longrightarrow> (dest = src \<longrightarrow> (\<forall>a b. ((a, b) = src \<longrightarrow> ((cdt s)(src := None)) src \<noteq> Some src) \<and> ((a, b) \<noteq> src \<longrightarrow> cdt s (a, b) \<noteq> Some src \<and> (cdt s (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(src := None)) (a, b) \<noteq> Some src)))) \<and> (dest \<noteq> src \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> (((cdt s)(dest := cdt s src)) dest = Some src \<longrightarrow> NullCap \<noteq> cap) \<and> (((cdt s)(dest := cdt s src)) dest \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) dest = Some dest \<longrightarrow> NullCap \<noteq> cap)) \<and> ((a, b) \<noteq> dest \<longrightarrow> ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some dest) \<and> ((a, b) \<noteq> src \<longrightarrow> (((cdt s)(dest := cdt s src)) (a, b) = Some src \<longrightarrow> NullCap \<noteq> cap \<and> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c)) \<and> (((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) = Some dest \<longrightarrow> NullCap \<noteq> cap \<and> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c))))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> ((a, b) = src \<longrightarrow> (\<forall>a b. ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some src) \<and> ((a, b) \<noteq> src \<longrightarrow> (((cdt s)(dest := cdt s src)) (a, b) = Some src \<longrightarrow> dest \<noteq> src) \<and> (((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) \<noteq> Some src)))) \<and> ((a, b) \<noteq> src \<longrightarrow> (\<forall>aa ba. ((aa, ba) = dest \<longrightarrow> (dest = src \<longrightarrow> ((cdt s)(src := None)) src \<noteq> Some (a, b)) \<and> (dest \<noteq> src \<longrightarrow> ((cdt s)(dest := cdt s src)) dest \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) dest = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> NullCap \<noteq> cap)) \<and> ((aa, ba) \<noteq> dest \<longrightarrow> ((aa, ba) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some (a, b)) \<and> ((aa, ba) \<noteq> src \<longrightarrow> ((cdt s)(dest := cdt s src)) (aa, ba) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c))))))
 2. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba)\<rbrakk> \<Longrightarrow> NullCap \<noteq> cap
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (4 subgoals):
 1. \<And>s capa a b aa ba ab bb. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba); NullCap \<noteq> cap\<rbrakk> \<Longrightarrow> (ab, bb) = dest \<longrightarrow> (dest = src \<longrightarrow> (\<forall>a b. ((a, b) = src \<longrightarrow> ((cdt s)(src := None)) src \<noteq> Some src) \<and> ((a, b) \<noteq> src \<longrightarrow> cdt s (a, b) \<noteq> Some src \<and> (cdt s (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(src := None)) (a, b) \<noteq> Some src)))) \<and> (dest \<noteq> src \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> (((cdt s)(dest := cdt s src)) dest = Some src \<longrightarrow> NullCap \<noteq> cap) \<and> (((cdt s)(dest := cdt s src)) dest \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) dest = Some dest \<longrightarrow> NullCap \<noteq> cap)) \<and> ((a, b) \<noteq> dest \<longrightarrow> ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some dest) \<and> ((a, b) \<noteq> src \<longrightarrow> (((cdt s)(dest := cdt s src)) (a, b) = Some src \<longrightarrow> NullCap \<noteq> cap \<and> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c)) \<and> (((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) = Some dest \<longrightarrow> NullCap \<noteq> cap \<and> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c))))))
 2. \<And>s capa a b aa ba ab bb. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba); NullCap \<noteq> cap\<rbrakk> \<Longrightarrow> (ab, bb) \<noteq> dest \<longrightarrow> ((ab, bb) = src \<longrightarrow> (\<forall>a b. ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some src) \<and> ((a, b) \<noteq> src \<longrightarrow> (((cdt s)(dest := cdt s src)) (a, b) = Some src \<longrightarrow> dest \<noteq> src) \<and> (((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) \<noteq> Some src)))) \<and> ((ab, bb) \<noteq> src \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> (dest = src \<longrightarrow> ((cdt s)(src := None)) src \<noteq> Some (ab, bb)) \<and> (dest \<noteq> src \<longrightarrow> ((cdt s)(dest := cdt s src)) dest \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) dest = Some (ab, bb) \<longrightarrow> (\<exists>c. caps_of_state s (ab, bb) = Some c \<and> NullCap \<noteq> c) \<and> NullCap \<noteq> cap)) \<and> ((a, b) \<noteq> dest \<longrightarrow> ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some (ab, bb)) \<and> ((a, b) \<noteq> src \<longrightarrow> ((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) = Some (ab, bb) \<longrightarrow> (\<exists>c. caps_of_state s (ab, bb) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c)))))
 3. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba)\<rbrakk> \<Longrightarrow> NullCap \<noteq> cap
 4. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba ab bb. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba); NullCap \<noteq> cap\<rbrakk> \<Longrightarrow> (ab, bb) \<noteq> dest \<longrightarrow> ((ab, bb) = src \<longrightarrow> (\<forall>a b. ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some src) \<and> ((a, b) \<noteq> src \<longrightarrow> (((cdt s)(dest := cdt s src)) (a, b) = Some src \<longrightarrow> dest \<noteq> src) \<and> (((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) \<noteq> Some src)))) \<and> ((ab, bb) \<noteq> src \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> (dest = src \<longrightarrow> ((cdt s)(src := None)) src \<noteq> Some (ab, bb)) \<and> (dest \<noteq> src \<longrightarrow> ((cdt s)(dest := cdt s src)) dest \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) dest = Some (ab, bb) \<longrightarrow> (\<exists>c. caps_of_state s (ab, bb) = Some c \<and> NullCap \<noteq> c) \<and> NullCap \<noteq> cap)) \<and> ((a, b) \<noteq> dest \<longrightarrow> ((a, b) = src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) src \<noteq> Some (ab, bb)) \<and> ((a, b) \<noteq> src \<longrightarrow> ((cdt s)(dest := cdt s src)) (a, b) \<noteq> Some src \<longrightarrow> ((cdt s)(dest := cdt s src, src := None)) (a, b) = Some (ab, bb) \<longrightarrow> (\<exists>c. caps_of_state s (ab, bb) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c)))))
 2. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba)\<rbrakk> \<Longrightarrow> NullCap \<noteq> cap
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba ab bb. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (aa, ba) = Some NullCap; caps_of_state s (a, b) = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba); NullCap \<noteq> cap; ab = aa \<longrightarrow> bb \<noteq> ba\<rbrakk> \<Longrightarrow> (ab = a \<and> bb = b \<longrightarrow> (\<forall>ab bb. (ab = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> ((if ab = aa \<and> bb = ba then cdt s (a, b) else cdt s (ab, bb)) = Some (a, b) \<longrightarrow> aa = a \<longrightarrow> ba \<noteq> b) \<and> ((if ab = aa \<and> bb = ba then cdt s (a, b) else cdt s (ab, bb)) \<noteq> Some (a, b) \<longrightarrow> (if ab = a \<and> bb = b then None else ((cdt s)((aa, ba) := cdt s (a, b))) (ab, bb)) \<noteq> Some (a, b)))) \<and> ((ab = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> (\<forall>ac bc. (ac = aa \<and> bc = ba \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> cdt s (a, b) \<noteq> Some (a, b) \<longrightarrow> (if aa = a \<and> ba = b then None else ((cdt s)((aa, ba) := cdt s (a, b))) (aa, ba)) = Some (ab, bb) \<longrightarrow> (\<exists>c. caps_of_state s (ab, bb) = Some c \<and> NullCap \<noteq> c)) \<and> ((ac = aa \<longrightarrow> bc \<noteq> ba) \<longrightarrow> (ac = a \<longrightarrow> bc \<noteq> b) \<longrightarrow> (if ac = aa \<and> bc = ba then cdt s (a, b) else cdt s (ac, bc)) \<noteq> Some (a, b) \<longrightarrow> (if ac = a \<and> bc = b then None else ((cdt s)((aa, ba) := cdt s (a, b))) (ac, bc)) = Some (ab, bb) \<longrightarrow> (\<exists>c. caps_of_state s (ab, bb) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (ac, bc) = Some c \<and> NullCap \<noteq> c))))
 2. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba)\<rbrakk> \<Longrightarrow> NullCap \<noteq> cap
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (4 subgoals):
 1. \<And>s capa a b aa ba ab bb. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (aa, ba) = Some NullCap; caps_of_state s (a, b) = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba); NullCap \<noteq> cap; ab = aa \<longrightarrow> bb \<noteq> ba\<rbrakk> \<Longrightarrow> ab = a \<and> bb = b \<longrightarrow> (\<forall>ab bb. (ab = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> ((if ab = aa \<and> bb = ba then cdt s (a, b) else cdt s (ab, bb)) = Some (a, b) \<longrightarrow> aa = a \<longrightarrow> ba \<noteq> b) \<and> ((if ab = aa \<and> bb = ba then cdt s (a, b) else cdt s (ab, bb)) \<noteq> Some (a, b) \<longrightarrow> (if ab = a \<and> bb = b then None else ((cdt s)((aa, ba) := cdt s (a, b))) (ab, bb)) \<noteq> Some (a, b)))
 2. \<And>s capa a b aa ba ab bb. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (aa, ba) = Some NullCap; caps_of_state s (a, b) = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba); NullCap \<noteq> cap; ab = aa \<longrightarrow> bb \<noteq> ba\<rbrakk> \<Longrightarrow> (ab = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> (\<forall>ac bc. (ac = aa \<and> bc = ba \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> cdt s (a, b) \<noteq> Some (a, b) \<longrightarrow> (if aa = a \<and> ba = b then None else ((cdt s)((aa, ba) := cdt s (a, b))) (aa, ba)) = Some (ab, bb) \<longrightarrow> (\<exists>c. caps_of_state s (ab, bb) = Some c \<and> NullCap \<noteq> c)) \<and> ((ac = aa \<longrightarrow> bc \<noteq> ba) \<longrightarrow> (ac = a \<longrightarrow> bc \<noteq> b) \<longrightarrow> (if ac = aa \<and> bc = ba then cdt s (a, b) else cdt s (ac, bc)) \<noteq> Some (a, b) \<longrightarrow> (if ac = a \<and> bc = b then None else ((cdt s)((aa, ba) := cdt s (a, b))) (ac, bc)) = Some (ab, bb) \<longrightarrow> (\<exists>c. caps_of_state s (ab, bb) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (ac, bc) = Some c \<and> NullCap \<noteq> c)))
 3. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba)\<rbrakk> \<Longrightarrow> NullCap \<noteq> cap
 4. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba ab bb. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (aa, ba) = Some NullCap; caps_of_state s (a, b) = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba); NullCap \<noteq> cap; ab = aa \<longrightarrow> bb \<noteq> ba\<rbrakk> \<Longrightarrow> (ab = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> (\<forall>ac bc. (ac = aa \<and> bc = ba \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> cdt s (a, b) \<noteq> Some (a, b) \<longrightarrow> (if aa = a \<and> ba = b then None else ((cdt s)((aa, ba) := cdt s (a, b))) (aa, ba)) = Some (ab, bb) \<longrightarrow> (\<exists>c. caps_of_state s (ab, bb) = Some c \<and> NullCap \<noteq> c)) \<and> ((ac = aa \<longrightarrow> bc \<noteq> ba) \<longrightarrow> (ac = a \<longrightarrow> bc \<noteq> b) \<longrightarrow> (if ac = aa \<and> bc = ba then cdt s (a, b) else cdt s (ac, bc)) \<noteq> Some (a, b) \<longrightarrow> (if ac = a \<and> bc = b then None else ((cdt s)((aa, ba) := cdt s (a, b))) (ac, bc)) = Some (ab, bb) \<longrightarrow> (\<exists>c. caps_of_state s (ab, bb) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (ac, bc) = Some c \<and> NullCap \<noteq> c)))
 2. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba)\<rbrakk> \<Longrightarrow> NullCap \<noteq> cap
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; src = (a, b); dest = (aa, ba)\<rbrakk> \<Longrightarrow> NullCap \<noteq> cap
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> mdb_move_abs src dest (cdt s) s proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> mdb_move_abs src dest (cdt s) s
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (5 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> valid_mdb s
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) NullCap) dest s
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> cdt s = cdt s
 4. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> src \<noteq> dest
 5. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (4 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) NullCap) dest s
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> cdt s = cdt s
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> src \<noteq> dest
 4. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> cdt s = cdt s
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> src \<noteq> dest
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap\<rbrakk> \<Longrightarrow> src \<noteq> dest
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> \<forall>a b. (src \<in> descendants_of (a, b) (cdt s) \<longrightarrow> (a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))) \<and> (src \<notin> descendants_of (a, b) (cdt s) \<longrightarrow> ((a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s))))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> (src \<in> descendants_of (a, b) (cdt s) \<longrightarrow> (a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))) \<and> (src \<notin> descendants_of (a, b) (cdt s) \<longrightarrow> ((a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s))))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> src \<in> descendants_of (a, b) (cdt s) \<longrightarrow> (a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))
 2. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> src \<notin> descendants_of (a, b) (cdt s) \<longrightarrow> ((a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s)))
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (a, b) = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src (a, b) (cdt s) s; mdb_move_abs_gen src (a, b) (cdt s) s; src \<in> descendants_of (a, b) (cdt s); dest = (a, b); (a, b) \<noteq> src; is_untyped_cap cap\<rbrakk> \<Longrightarrow> (aa = a \<and> ba = b \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s)) \<and> ((aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> (aa, ba) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of src (cdt s)))
 2. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> src \<notin> descendants_of (a, b) (cdt s) \<longrightarrow> ((a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s)))
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (a, b) = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src (a, b) (cdt s) s; mdb_move_abs_gen src (a, b) (cdt s) s; src \<in> descendants_of (a, b) (cdt s); dest = (a, b); (a, b) \<noteq> src; is_untyped_cap cap\<rbrakk> \<Longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> (aa, ba) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of src (cdt s))
 2. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> src \<notin> descendants_of (a, b) (cdt s) \<longrightarrow> ((a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s)))
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba cap'. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> cdt s \<Turnstile> (a, b) \<rightarrow> (aa, ba)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (a, b) = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src (a, b) (cdt s) s; mdb_move_abs_gen src (a, b) (cdt s) s; cdt s \<Turnstile> (a, b) \<rightarrow> src; dest = (a, b); (a, b) \<noteq> src; is_untyped_cap cap; aa = a \<longrightarrow> ba \<noteq> b; (aa, ba) \<noteq> src; caps_of_state s (aa, ba) = Some cap'; obj_refs cap' \<inter> untyped_range cap \<noteq> {}\<rbrakk> \<Longrightarrow> cdt s \<Turnstile> src \<rightarrow> (aa, ba)
 2. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> src \<notin> descendants_of (a, b) (cdt s) \<longrightarrow> ((a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s)))
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba cap'. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> cdt s \<Turnstile> (a, b) \<rightarrow> (aa, ba)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (a, b) = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src (a, b) (cdt s) s; mdb_move_abs_gen src (a, b) (cdt s) s; dest = (a, b); (a, b) \<noteq> src; is_untyped_cap cap; aa = a \<longrightarrow> ba \<noteq> b; (aa, ba) \<noteq> src; caps_of_state s (aa, ba) = Some cap'; obj_refs cap' \<inter> untyped_range cap \<noteq> {}; \<exists>z. cdt s \<Turnstile> (a, b) \<leadsto> z \<and> cdt s \<Turnstile> z \<rightarrow>* src\<rbrakk> \<Longrightarrow> cdt s \<Turnstile> src \<rightarrow> (aa, ba)
 2. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> src \<notin> descendants_of (a, b) (cdt s) \<longrightarrow> ((a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s)))
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba cap' ab bb. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> cdt s \<Turnstile> (a, b) \<rightarrow> (aa, ba)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (a, b) = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src (a, b) (cdt s) s; mdb_move_abs_gen src (a, b) (cdt s) s; dest = (a, b); (a, b) \<noteq> src; is_untyped_cap cap; aa = a \<longrightarrow> ba \<noteq> b; (aa, ba) \<noteq> src; caps_of_state s (aa, ba) = Some cap'; obj_refs cap' \<inter> untyped_range cap \<noteq> {}; cdt s (ab, bb) = Some (a, b); cdt s \<Turnstile> (ab, bb) \<rightarrow>* src\<rbrakk> \<Longrightarrow> cdt s \<Turnstile> src \<rightarrow> (aa, ba)
 2. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> src \<notin> descendants_of (a, b) (cdt s) \<longrightarrow> ((a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s)))
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> src \<notin> descendants_of (a, b) (cdt s) \<longrightarrow> ((a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s)))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s; src \<notin> descendants_of (a, b) (cdt s)\<rbrakk> \<Longrightarrow> ((a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s)))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s; src \<notin> descendants_of (a, b) (cdt s)\<rbrakk> \<Longrightarrow> (a, b) = dest \<longrightarrow> dest \<noteq> src \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>a b. ((a, b) = dest \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> dest \<in> descendants_of src (cdt s)) \<and> ((a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s))))
 2. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s; src \<notin> descendants_of (a, b) (cdt s)\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s))
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (a, b) = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src (a, b) (cdt s) s; mdb_move_abs_gen src (a, b) (cdt s) s; src \<notin> descendants_of (a, b) (cdt s); dest = (a, b); (a, b) \<noteq> src; is_untyped_cap cap\<rbrakk> \<Longrightarrow> (aa = a \<and> ba = b \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of src (cdt s)) \<and> ((aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> (aa, ba) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of src (cdt s)))
 2. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s; src \<notin> descendants_of (a, b) (cdt s)\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s))
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (a, b) = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src (a, b) (cdt s) s; mdb_move_abs_gen src (a, b) (cdt s) s; src \<notin> descendants_of (a, b) (cdt s); dest = (a, b); (a, b) \<noteq> src; is_untyped_cap cap\<rbrakk> \<Longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> (aa, ba) \<noteq> src \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of src (cdt s))
 2. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s; src \<notin> descendants_of (a, b) (cdt s)\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s))
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba cap'. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (a, b) = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src (a, b) (cdt s) s; mdb_move_abs_gen src (a, b) (cdt s) s; src \<notin> descendants_of (a, b) (cdt s); dest = (a, b); (a, b) \<noteq> src; is_untyped_cap cap; aa = a \<longrightarrow> ba \<noteq> b; (aa, ba) \<noteq> src; caps_of_state s (aa, ba) = Some cap'; obj_refs cap' \<inter> untyped_range cap \<noteq> {}\<rbrakk> \<Longrightarrow> (aa, ba) \<in> descendants_of src (cdt s)
 2. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s; src \<notin> descendants_of (a, b) (cdt s)\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s))
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba cap'. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (a, b) = Some NullCap; caps_of_state s src = Some capa; capa \<noteq> NullCap; mdb_move_abs src (a, b) (cdt s) s; mdb_move_abs_gen src (a, b) (cdt s) s; src \<notin> descendants_of (a, b) (cdt s); dest = (a, b); (a, b) \<noteq> src; is_untyped_cap cap; aa = a \<longrightarrow> ba \<noteq> b; (aa, ba) \<noteq> src; caps_of_state s (aa, ba) = Some cap'; obj_refs cap' \<inter> untyped_range cap \<noteq> {}; capa = cap\<rbrakk> \<Longrightarrow> (aa, ba) \<in> descendants_of src (cdt s)
 2. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s; src \<notin> descendants_of (a, b) (cdt s)\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s))
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b aa ba cap' ab bb. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (a, b) = Some NullCap; caps_of_state s src = Some capa; capa \<noteq> NullCap; mdb_move_abs src (a, b) (cdt s) s; mdb_move_abs_gen src (a, b) (cdt s) s; src \<notin> descendants_of (a, b) (cdt s); dest = (a, b); (a, b) \<noteq> src; is_untyped_cap cap; aa = a \<longrightarrow> ba \<noteq> b; (aa, ba) \<noteq> src; caps_of_state s (aa, ba) = Some cap'; obj_refs cap' \<inter> untyped_range cap \<noteq> {}; capa = cap; src = (ab, bb)\<rbrakk> \<Longrightarrow> (aa, ba) \<in> descendants_of src (cdt s)
 2. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s; src \<notin> descendants_of (a, b) (cdt s)\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s))
 3. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s; src \<notin> descendants_of (a, b) (cdt s)\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest \<longrightarrow> (a, b) \<noteq> src \<longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest \<noteq> src \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> is_untyped_cap capa \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> dest \<in> descendants_of (a, b) (cdt s))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b aa ba capaa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (aa, ba) = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src (aa, ba) (cdt s) s; mdb_move_abs_gen src (aa, ba) (cdt s) s; src \<notin> descendants_of (a, b) (cdt s); (a, b) \<noteq> src; dest = (aa, ba); a = aa \<longrightarrow> b \<noteq> ba; (aa, ba) \<noteq> src; caps_of_state s (a, b) = Some capaa; is_untyped_cap capaa; obj_refs cap \<inter> untyped_range capaa \<noteq> {}\<rbrakk> \<Longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b aa ba capaa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (aa, ba) = Some NullCap; caps_of_state s src = Some capa; capa \<noteq> NullCap; mdb_move_abs src (aa, ba) (cdt s) s; mdb_move_abs_gen src (aa, ba) (cdt s) s; src \<notin> descendants_of (a, b) (cdt s); (a, b) \<noteq> src; dest = (aa, ba); a = aa \<longrightarrow> b \<noteq> ba; (aa, ba) \<noteq> src; caps_of_state s (a, b) = Some capaa; is_untyped_cap capaa; obj_refs cap \<inter> untyped_range capaa \<noteq> {}; obj_refs cap = obj_refs capa\<rbrakk> \<Longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b aa ba capaa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (aa, ba) = Some NullCap; caps_of_state s src = Some capa; capa \<noteq> NullCap; mdb_move_abs src (aa, ba) (cdt s) s; mdb_move_abs_gen src (aa, ba) (cdt s) s; src \<notin> descendants_of (a, b) (cdt s); (a, b) \<noteq> src; dest = (aa, ba); a = aa \<longrightarrow> b \<noteq> ba; (aa, ba) \<noteq> src; caps_of_state s (a, b) = Some capaa; is_untyped_cap capaa; obj_refs capa \<inter> untyped_range capaa \<noteq> {}; obj_refs cap = obj_refs capa\<rbrakk> \<Longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b aa ba capaa ab bb. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s (aa, ba) = Some NullCap; caps_of_state s src = Some capa; capa \<noteq> NullCap; mdb_move_abs src (aa, ba) (cdt s) s; mdb_move_abs_gen src (aa, ba) (cdt s) s; src \<notin> descendants_of (a, b) (cdt s); (a, b) \<noteq> src; dest = (aa, ba); a = aa \<longrightarrow> b \<noteq> ba; (aa, ba) \<noteq> src; caps_of_state s (a, b) = Some capaa; is_untyped_cap capaa; obj_refs capa \<inter> untyped_range capaa \<noteq> {}; obj_refs cap = obj_refs capa; src = (ab, bb)\<rbrakk> \<Longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> descendants_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) \<and> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> no_mloop (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r)
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> dest = src \<or> (src, dest) \<notin> (cdt_parent_rel (cdt s))\<^sup>+
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> untyped_inc (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>p. caps_of_state s p = Some IRQControlCap \<longrightarrow> is_original_cap s p; reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> dest \<noteq> src \<longrightarrow> cap = IRQControlCap \<longrightarrow> is_original_cap s src
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some IRQControlCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s; dest \<noteq> src; cap = IRQControlCap\<rbrakk> \<Longrightarrow> is_original_cap s src
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap))
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); \<forall>p cap. caps_of_state s p = Some cap \<longrightarrow> is_master_reply_cap cap \<longrightarrow> is_original_cap s p; reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> dest \<noteq> src \<longrightarrow> is_master_reply_cap cap \<longrightarrow> is_original_cap s src
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s; caps_of_state s src = Some capa \<longrightarrow> is_master_reply_cap capa \<longrightarrow> is_original_cap s src\<rbrakk> \<Longrightarrow> dest \<noteq> src \<longrightarrow> is_master_reply_cap cap \<longrightarrow> is_original_cap s src
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s; caps_of_state s src = Some capa \<longrightarrow> is_master_reply_cap capa \<longrightarrow> is_original_cap s src; dest \<noteq> src; is_master_reply_cap cap\<rbrakk> \<Longrightarrow> is_original_cap s src
 2. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> reply_mdb (\<lambda>r. if (if r = src then None else ((cdt s)(dest := cdt s src)) r) = Some src then Some dest else ((cdt s)(dest := cdt s src, src := None)) r) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c) \<and> (\<exists>c. caps_of_state s (aa, ba) = Some c \<and> NullCap \<noteq> c); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s dest = Some NullCap; caps_of_state s src = Some capa; weak_derived cap capa; capa \<noteq> NullCap; mdb_move_abs src dest (cdt s) s; mdb_move_abs_gen src dest (cdt s) s\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_original_cap s src, src := False)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> NullCap)) proof (prove)
goal:
No subgoals!