theory CNodeInv_R

lemma (in mdb_swap) cteSwap_chunked:
  "mdb_chunked n" proof - from valid have "mdb_chunked m" .. thus ?thesis apply (clarsimp simp add: mdb_chunked_def is_chunk_def n_trancl n_rtrancl n_cap_eq) apply (case_tac "p = dest") apply simp apply (case_tac "p' = src") apply (clarsimp simp add: region_simps) apply (erule_tac x=src in allE) apply (erule_tac x=dest in allE) apply clarsimp apply (erule disjE) apply clarsimp apply (rule conjI) apply clarsimp apply (erule_tac x="s_d_swap p'' src dest" in allE) apply clarsimp apply (case_tac "p'' = dest", simp) apply simp apply (case_tac "p'' = src") apply (clarsimp simp: region_simps) apply simp apply clarsimp apply (drule (1) trancl_trans) apply simp apply simp apply (rule conjI) apply clarsimp apply (drule (1) trancl_trans) apply simp apply clarsimp apply (erule_tac x="s_d_swap p'' src dest" in allE) apply clarsimp apply (case_tac "p'' = dest") apply (clarsimp simp: region_simps) apply simp apply (case_tac "p'' = src", simp) apply simp apply (clarsimp simp: region_simps) apply (erule_tac x=src in allE) apply clarsimp apply (erule_tac x="s_d_swap p' src dest" in allE) apply clarsimp apply (erule impE) apply (clarsimp simp: s_d_swap_def) apply clarsimp apply (erule disjE) apply clarsimp apply (rule conjI) apply clarsimp apply (case_tac "p''=dest", simp) apply clarsimp apply (case_tac "p''=src") apply (clarsimp simp: dest) apply (clarsimp simp: region_simps) apply (erule_tac x=dest in allE) apply (clarsimp simp: dest) apply clarsimp apply clarsimp apply (drule (1) trancl_trans, simp) apply clarsimp apply (rule conjI) apply clarsimp apply (drule (1) trancl_trans, simp) apply clarsimp apply (case_tac "p''=dest") apply (clarsimp simp: region_simps) apply (erule_tac x=src in allE) apply clarsimp apply clarsimp apply (case_tac "p''=src") apply (simp add: dest region_simps) apply (erule_tac x=dest in allE) apply (clarsimp simp: dest) apply simp apply clarsimp apply (case_tac "p'=dest") apply clarsimp apply (case_tac "p=src") apply (clarsimp simp: region_simps) apply (erule_tac x=dest in allE) apply (erule_tac x=src in allE) apply clarsimp apply (erule disjE) apply clarsimp apply (rule conjI) apply clarsimp apply (case_tac "p''=dest") apply (simp add: region_simps) apply simp apply (case_tac "p''=src") apply (simp add: region_simps) apply simp apply clarsimp apply (drule (1) trancl_trans) apply simp apply clarsimp apply (rule conjI) apply clarsimp apply (drule (1) trancl_trans) apply simp apply clarsimp apply (case_tac "p''=dest") apply (simp add: region_simps) apply simp apply (case_tac "p''=src") apply (simp add: region_simps) apply (erule_tac x="dest" in allE) apply simp apply simp apply clarsimp apply (erule_tac x="s_d_swap p src dest" in allE) apply (erule_tac x="src" in allE) apply (clarsimp simp: region_simps) apply (rule conjI) apply clarsimp apply (case_tac "p''=dest") apply (simp add: region_simps) apply (case_tac "p''=src") apply (simp add: region_simps dest) apply (erule_tac x=dest in allE) apply (clarsimp simp: dest) apply simp apply clarsimp apply (case_tac "p''=dest") apply (simp add: region_simps) apply (case_tac "p''=src") apply (simp add: region_simps dest) apply (erule_tac x=dest in allE) apply (clarsimp simp: dest) apply simp apply clarsimp apply (case_tac "p'=src") apply clarsimp apply (erule_tac x="s_d_swap p src dest" in allE) apply (erule_tac x=dest in allE) apply (clarsimp simp: region_simps) apply (erule impE) apply (clarsimp simp: s_d_swap_def) apply clarsimp apply (rule conjI) apply clarsimp apply (case_tac "p''=src") apply (simp add: region_simps) apply (case_tac "p''=dest") apply (simp add: src region_simps) apply (erule_tac x=src in allE) apply (simp add: src) apply clarsimp apply clarsimp apply (case_tac "p''=src") apply (simp add: region_simps) apply (case_tac "p''=dest") apply (simp add: src region_simps) apply (erule_tac x=src in allE) apply (simp add: src) apply clarsimp apply clarsimp apply (case_tac "p=src") apply clarsimp apply (erule_tac x="dest" in allE) apply (erule_tac x="s_d_swap p' src dest" in allE) apply (clarsimp simp: region_simps) apply (erule impE) apply (clarsimp simp: s_d_swap_def) apply clarsimp apply (rule conjI) apply clarsimp apply (case_tac "p''=dest") apply (simp add: src region_simps) apply (erule_tac x=src in allE) apply (simp add: src) apply simp apply (case_tac "p''=src") apply (simp add: region_simps) apply simp apply clarsimp apply (case_tac "p''=dest") apply (simp add: src region_simps) apply (erule_tac x=src in allE) apply (simp add: src) apply simp apply (case_tac "p''=src") apply (simp add: region_simps) apply (erule_tac x=dest in allE) apply (simp add: dest) apply simp apply clarsimp apply (erule_tac x="s_d_swap p src dest" in allE) apply (erule_tac x="s_d_swap p' src dest" in allE) apply clarsimp apply (rule conjI) apply clarsimp apply (case_tac "p''=dest") apply (simp add: src region_simps) apply (erule_tac x=src in allE) apply (simp add: src) apply (case_tac "p''=src") apply (simp add: region_simps) apply (erule_tac x=dest in allE) apply (simp add: dest) apply simp apply clarsimp apply (case_tac "p''=dest") apply (simp add: src region_simps) apply (erule_tac x=src in allE) apply (simp add: src) apply (case_tac "p''=src") apply (simp add: region_simps) apply (erule_tac x=dest in allE) apply (simp add: dest) apply simp done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. mdb_chunked n proof (state)
goal (1 subgoal):
 1. mdb_chunked n proof (chain)
picking this:
valid_mdb_ctes m proof (prove)
using this:
valid_mdb_ctes m

goal (1 subgoal):
 1. mdb_chunked m proof (state)
this:
mdb_chunked m

goal (1 subgoal):
 1. mdb_chunked n proof (prove)
using this:
mdb_chunked m

goal (1 subgoal):
 1. mdb_chunked n proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p = dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' = src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p' cap. (\<exists>n. m src = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> src \<noteq> p' \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>cap. (\<exists>n. m src = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m dest = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> src \<noteq> dest \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 3. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 3. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 4. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 4. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m (s_d_swap p'' src dest) = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 4. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>n n' p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; global.sameRegionAs src_cap cap''; m (s_d_swap p'' src dest) = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''a. (\<exists>n''a. (p'' = dest \<longrightarrow> n = n''a \<and> cap''a = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n''a \<and> cap''a = dcap) \<and> (p'' \<noteq> src \<longrightarrow> cap'' = cap''a \<and> n'' = n''a))) \<and> global.sameRegionAs src_cap cap''a
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 4. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>n n' p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; global.sameRegionAs src_cap cap''; m (s_d_swap p'' src dest) = Some (CTE cap'' n''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''a. (\<exists>n''a. (p'' = dest \<longrightarrow> n = n''a \<and> cap''a = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n''a \<and> cap''a = dcap) \<and> (p'' \<noteq> src \<longrightarrow> cap'' = cap''a \<and> n'' = n''a))) \<and> global.sameRegionAs src_cap cap''a
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 4. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>n n' p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; global.sameRegionAs src_cap cap''; m (s_d_swap p'' src dest) = Some (CTE cap'' n''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''a. (\<exists>n''a. (p'' = src \<longrightarrow> n' = n''a \<and> cap''a = dcap) \<and> (p'' \<noteq> src \<longrightarrow> cap'' = cap''a \<and> n'' = n''a)) \<and> global.sameRegionAs src_cap cap''a
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 4. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (6 subgoals):
 1. \<And>n n' p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; global.sameRegionAs src_cap cap''; m (s_d_swap p'' src dest) = Some (CTE cap'' n''); p'' \<noteq> dest; p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''a. (\<exists>n''a. (p'' = src \<longrightarrow> n' = n''a \<and> cap''a = dcap) \<and> (p'' \<noteq> src \<longrightarrow> cap'' = cap''a \<and> n'' = n''a)) \<and> global.sameRegionAs src_cap cap''a
 2. \<And>n n' p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; global.sameRegionAs src_cap cap''; m (s_d_swap p'' src dest) = Some (CTE cap'' n''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''a. (\<exists>n''a. (p'' = src \<longrightarrow> n' = n''a \<and> cap''a = dcap) \<and> (p'' \<noteq> src \<longrightarrow> cap'' = cap''a \<and> n'' = n''a)) \<and> global.sameRegionAs src_cap cap''a
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 4. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 5. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 6. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>n n' p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; global.sameRegionAs src_cap cap''; m (s_d_swap p'' src dest) = Some (CTE cap'' n''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''a. (\<exists>n''a. (p'' = src \<longrightarrow> n' = n''a \<and> cap''a = dcap) \<and> (p'' \<noteq> src \<longrightarrow> cap'' = cap''a \<and> n'' = n''a)) \<and> global.sameRegionAs src_cap cap''a
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 4. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 3. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 3. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 3. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')
 3. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')
 3. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')
 3. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m (s_d_swap p'' src dest) = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n' p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; global.sameRegionAs dest_cap cap''; m (s_d_swap p'' src dest) = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''a. (\<exists>n''a. (p'' = dest \<longrightarrow> n = n''a \<and> cap''a = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n''a \<and> cap''a = dcap) \<and> (p'' \<noteq> src \<longrightarrow> cap'' = cap''a \<and> n'' = n''a))) \<and> global.sameRegionAs dest_cap cap''a
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; global.sameRegionAs dest_cap cap''; m (s_d_swap p'' src dest) = Some (CTE cap'' n''); p'' = dest\<rbrakk> \<Longrightarrow> \<exists>cap''a. (\<exists>n''a. (p'' = dest \<longrightarrow> n = n''a \<and> cap''a = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n''a \<and> cap''a = dcap) \<and> (p'' \<noteq> src \<longrightarrow> cap'' = cap''a \<and> n'' = n''a))) \<and> global.sameRegionAs dest_cap cap''a
 2. \<And>n n' p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; global.sameRegionAs dest_cap cap''; m (s_d_swap p'' src dest) = Some (CTE cap'' n''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''a. (\<exists>n''a. (p'' = dest \<longrightarrow> n = n''a \<and> cap''a = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n''a \<and> cap''a = dcap) \<and> (p'' \<noteq> src \<longrightarrow> cap'' = cap''a \<and> n'' = n''a))) \<and> global.sameRegionAs dest_cap cap''a
 3. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n' p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; global.sameRegionAs dest_cap cap''; m (s_d_swap p'' src dest) = Some (CTE cap'' n''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''a. (\<exists>n''a. (p'' = dest \<longrightarrow> n = n''a \<and> cap''a = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n''a \<and> cap''a = dcap) \<and> (p'' \<noteq> src \<longrightarrow> cap'' = cap''a \<and> n'' = n''a))) \<and> global.sameRegionAs dest_cap cap''a
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n' p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; global.sameRegionAs dest_cap cap''; m (s_d_swap p'' src dest) = Some (CTE cap'' n''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''a. (\<exists>n''a. (p'' = src \<longrightarrow> n' = n''a \<and> cap''a = dcap) \<and> (p'' \<noteq> src \<longrightarrow> cap'' = cap''a \<and> n'' = n''a)) \<and> global.sameRegionAs dest_cap cap''a
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n' p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap n); m dest = Some (CTE dest_cap n'); global.sameRegionAs src_cap dest_cap; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; global.sameRegionAs dest_cap cap''; m (s_d_swap p'' src dest) = Some (CTE cap'' n''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''a. (\<exists>n''a. (p'' = src \<longrightarrow> n' = n''a \<and> cap''a = dcap) \<and> (p'' \<noteq> src \<longrightarrow> cap'' = cap''a \<and> n'' = n''a)) \<and> global.sameRegionAs dest_cap cap''a
 2. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs scap cap'; dest \<noteq> p'; p = dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p' cap. (\<exists>n. m src = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> src \<noteq> p' \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p' cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs src_cap cap' \<longrightarrow> src \<noteq> p' \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>cap'. (\<exists>n'. m (s_d_swap p' src dest) = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs src_cap cap' \<longrightarrow> src \<noteq> s_d_swap p' src dest \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; src \<noteq> s_d_swap p' src dest \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src\<rbrakk> \<Longrightarrow> src \<noteq> s_d_swap p' src dest
 2. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')
 2. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 3. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 3. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 3. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 3. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; p'' \<noteq> dest; p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 3. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 4. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p' src dest\<rbrakk> \<Longrightarrow> global.sameRegionAs src_cap dcap
 2. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 3. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 4. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p' src dest\<rbrakk> \<Longrightarrow> global.sameRegionAs src_cap dest_cap
 2. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 3. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 4. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m dest = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs src_cap dest_cap
 2. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 3. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 4. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 3. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 2. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))) \<and> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 2. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' = dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' src_cap
 2. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> m \<turnstile> src \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m src = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' src_cap
 2. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest; p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* src; p'' = src\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' dest_cap
 2. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* src; p'' = src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m dest = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' dest_cap
 2. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>m src = Some (CTE src_cap n); m (s_d_swap p' src dest) = Some (CTE cap' n'); global.sameRegionAs src_cap cap'; dest \<noteq> p'; p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p = dest \<longrightarrow> m src = Some (CTE src_cap n) \<and> cap = scap; p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap) \<and> (p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' = dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n)\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p = src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 2. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n)\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 2. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p' cap. (\<exists>n. m dest = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> dest \<noteq> p' \<longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 2. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>cap. (\<exists>n. m dest = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m src = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> dest \<noteq> src \<longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 2. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 2. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 3. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 3. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 4. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 4. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (6 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' = dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 4. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 5. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 6. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 4. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 4. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (6 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest; p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs dest_cap cap''
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 4. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 5. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 6. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (5 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 3. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 4. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 5. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 3. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 3. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 3. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 2. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 2. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')
 3. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')
 3. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')
 3. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')
 2. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; p'' = dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 3. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; p'' \<noteq> dest; p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 3. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; p'' = src\<rbrakk> \<Longrightarrow> global.sameRegionAs src_cap dest_cap
 2. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 3. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ dest; p'' = src; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m dest = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs src_cap dest_cap
 2. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 3. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs dest_cap src_cap; m dest = Some (CTE dest_cap n); m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; \<forall>p' cap. (\<exists>n. m (s_d_swap p src dest) = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> s_d_swap p src dest \<noteq> p' \<longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap scap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; \<forall>cap. (\<exists>n. m (s_d_swap p src dest) = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m src = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> s_d_swap p src dest \<noteq> src \<longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs scap cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))
 2. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' = dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest; p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' = src\<rbrakk> \<Longrightarrow> global.sameRegionAs cap dest_cap
 2. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* src; p'' = src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m dest = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs cap dest_cap
 2. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* src; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); p'' = dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); p'' \<noteq> dest; p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); p'' = src\<rbrakk> \<Longrightarrow> global.sameRegionAs src_cap dest_cap
 2. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> src \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p src dest; p'' = src; m \<turnstile> src \<leadsto>\<^sup>+ dest \<longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m dest = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs src_cap dest_cap
 2. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>m src = Some (CTE src_cap n'); global.sameRegionAs cap src_cap; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> src \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> n' = n'' \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); p' = dest \<longrightarrow> m src = Some (CTE src_cap n') \<and> cap' = scap; p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap) \<and> (p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n')\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' = src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap dcap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n')\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dcap cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dcap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); \<forall>p' cap. (\<exists>n. m (s_d_swap p src dest) = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> s_d_swap p src dest \<noteq> p' \<longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dcap cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dcap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); \<forall>cap. (\<exists>n. m (s_d_swap p src dest) = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m dest = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> s_d_swap p src dest \<noteq> dest \<longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dcap cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); s_d_swap p src dest \<noteq> dest \<longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')))\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n')\<rbrakk> \<Longrightarrow> s_d_swap p src dest \<noteq> dest
 2. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')))\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')))\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))
 2. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> src; p'' = dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' = dest\<rbrakk> \<Longrightarrow> global.sameRegionAs cap src_cap
 2. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>* dest; p'' = dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> m \<turnstile> src \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m src = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs cap src_cap
 2. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n'. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<or> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> src; p'' = dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' = dest\<rbrakk> \<Longrightarrow> global.sameRegionAs dest_cap src_cap
 2. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>* s_d_swap p src dest; p'' = dest; m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> m \<turnstile> src \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m src = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs dest_cap src_cap
 2. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap n n' p''. \<lbrakk>global.sameRegionAs cap dest_cap; p \<noteq> src; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); m dest = Some (CTE dest_cap n'); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> src; p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n' = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; p' = src \<longrightarrow> m dest = Some (CTE dest_cap n') \<and> cap' = dcap; p' \<noteq> src \<longrightarrow> m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p = src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs dcap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dcap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dcap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; \<forall>p' cap. (\<exists>n. m dest = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> dest \<noteq> p' \<longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dcap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dcap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; \<forall>cap. (\<exists>n. m dest = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m (s_d_swap p' src dest) = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> dest \<noteq> s_d_swap p' src dest \<longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dcap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; dest \<noteq> s_d_swap p' src dest \<longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> s_d_swap p' src dest
 2. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest) \<and> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> (m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''))
 2. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' = dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 3. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' = dest\<rbrakk> \<Longrightarrow> global.sameRegionAs dest_cap src_cap
 2. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 3. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>* s_d_swap p' src dest; p'' = dest; m \<turnstile> dest \<leadsto>\<^sup>+ src \<longrightarrow> m \<turnstile> src \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m src = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs dest_cap src_cap
 2. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 3. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (4 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> dest; p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs dest_cap cap''
 3. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 4. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs dest_cap cap''
 2. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n'. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' = dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' = dest\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' src_cap
 2. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>* dest; p'' = dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> m \<turnstile> src \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m src = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' src_cap
 2. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest; p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' = src\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' dest_cap
 2. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (3 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; p'' = src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m dest = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' dest_cap
 2. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p' n cap' n' p''. \<lbrakk>global.sameRegionAs dest_cap cap'; m dest = Some (CTE dest_cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; m \<turnstile> dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs dest_cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = src \<longrightarrow> n = n'' \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n''))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; p = src \<longrightarrow> m dest = Some (CTE dest_cap n) \<and> cap = dcap; p \<noteq> src \<longrightarrow> m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; \<forall>p' cap. (\<exists>n. m (s_d_swap p src dest) = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> s_d_swap p src dest \<noteq> p' \<longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; \<forall>cap. (\<exists>n. m (s_d_swap p src dest) = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m (s_d_swap p' src dest) = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> s_d_swap p src dest \<noteq> s_d_swap p' src dest \<longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest) \<and> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))))\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> (m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''))
 2. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' = dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' = dest\<rbrakk> \<Longrightarrow> global.sameRegionAs cap src_cap
 2. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>* s_d_swap p' src dest; p'' = dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ src \<longrightarrow> m \<turnstile> src \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m src = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs cap src_cap
 2. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest; p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' = src\<rbrakk> \<Longrightarrow> (\<exists>n''. m dest = Some (CTE dest_cap n'')) \<and> global.sameRegionAs cap dest_cap
 2. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p' src dest; p'' = src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ dest \<longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m dest = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> (\<exists>n''. m dest = Some (CTE dest_cap n'')) \<and> global.sameRegionAs cap dest_cap
 2. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p' src dest; \<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<or> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest \<longrightarrow> m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' = dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' = dest\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' src_cap
 2. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>* s_d_swap p src dest; p'' = dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ src \<longrightarrow> m \<turnstile> src \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m src = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' src_cap
 2. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest; p'' = src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' = src\<rbrakk> \<Longrightarrow> (\<exists>n''. m dest = Some (CTE dest_cap n'')) \<and> global.sameRegionAs cap' dest_cap
 2. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest; m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p src dest; p'' = src; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ dest \<longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m dest = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> (\<exists>n''. m dest = Some (CTE dest_cap n'')) \<and> global.sameRegionAs cap' dest_cap
 2. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n' p''. \<lbrakk>global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m (s_d_swap p src dest) = Some (CTE cap n); p' \<noteq> dest; m (s_d_swap p' src dest) = Some (CTE cap' n'); p' \<noteq> src; p \<noteq> src; m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ s_d_swap p' src dest \<longrightarrow> (\<forall>p''. m \<turnstile> s_d_swap p src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p' src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p src dest; m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ s_d_swap p'' src dest; m \<turnstile> s_d_swap p'' src dest \<leadsto>\<^sup>* s_d_swap p src dest; \<forall>p''. m \<turnstile> s_d_swap p' src dest \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* s_d_swap p src dest \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest; p'' \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. (p'' = dest \<longrightarrow> m src = Some (CTE src_cap n'') \<and> cap'' = scap) \<and> (p'' \<noteq> dest \<longrightarrow> (p'' = src \<longrightarrow> m dest = Some (CTE dest_cap n'') \<and> cap'' = dcap) \<and> (p'' \<noteq> src \<longrightarrow> m (s_d_swap p'' src dest) = Some (CTE cap'' n'')))) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chunked n

goal:
No subgoals!