theory CNodeInv_AI

lemma decode_cnode_inv_wf[wp]:
  "\<And>cap.
    \<lbrace>invs and valid_cap cap
          and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s)
          and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s).
                 ex_cte_cap_wp_to is_cnode_cap r s))
          and (\<lambda>s. \<forall>cap \<in> set cs. s \<turnstile> cap)
          and (\<lambda>s. \<forall>cap \<in> set cs. is_cnode_cap cap \<longrightarrow>
                 (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<rbrace>
      decode_cnode_invocation mi args cap cs
    \<lbrace>valid_cnode_inv\<rbrace>,-" apply (rule decode_cnode_cases2[where args=args and exs=cs and label=mi])
         \<comment> \<open>Move/Insert\<close> apply (simp add: decode_cnode_invocation_def unlessE_whenE
                     split del: if_split) apply (wp lsfco_cte_at ensure_no_children_wp whenE_throwError_wp
          | simp add: split_beta split del: if_split
          | (fold validE_R_def)[1])+ apply (rule cap_derive_not_null_helper2) apply (simp only: imp_conjR) apply ((wp derive_cap_is_derived
                          derive_cap_valid_cap
                          derive_cap_zobjrefs derive_cap_objrefs_iszombie
                            | wp (once) hoare_drop_imps)+ )[1] apply (wp whenE_throwError_wp | wpcw)+ apply simp apply (rule_tac Q="\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x
                                       and zombies_final and valid_objs
                                       and real_cte_at src_slot and real_cte_at x
                                       and cte_wp_at (\<lambda>c. c = src_cap) src_slot
                                       and cte_wp_at ((=) cap.NullCap) x"
                       in hoare_post_imp) apply (rename_tac rv s) apply (clarsimp simp: cte_wp_at_caps_of_state all_rights_def) apply (simp add: cap_master_update_cap_data weak_derived_update_cap_data
                              cap_asid_update_cap_data
                              update_cap_data_validI update_cap_objrefs) apply (strengthen cap_badge_update_cap_data) apply simp apply (frule (1) caps_of_state_valid_cap) apply (case_tac "is_zombie rv") apply (clarsimp simp add: valid_cap_def2 update_cap_data_def
                                        is_cap_simps
                              split: if_split_asm) apply (frule(2) zombies_final_helper [OF caps_of_state_cteD[simplified cte_wp_at_eq_simp]]) apply (clarsimp simp: valid_cap_def2 cte_wp_at_caps_of_state) apply (rule conjI, clarsimp+)+ apply (fastforce simp: is_untyped_update_cap_data
                                    weak_derived_update_cap_data[OF _ weak_derived_refl]) apply (wp get_cap_cte_wp_at ensure_empty_cte_wp_at)+ apply simp apply (clarsimp simp: invs_def valid_state_def valid_pspace_def)
       \<comment> \<open>Revoke\<close> apply (simp add: decode_cnode_invocation_def unlessE_whenE cong: if_cong) apply (wp lsfco_cte_at hoare_drop_imps whenE_throwError_wp
                  | simp add: split_beta validE_R_def[symmetric])+ apply clarsimp
      \<comment> \<open>Delete\<close> apply (simp add: decode_cnode_invocation_def unlessE_whenE cong: if_cong) apply (wp lsfco_cte_at hoare_drop_imps whenE_throwError_wp
                 | simp add: split_beta validE_R_def[symmetric])+ apply clarsimp
     \<comment> \<open>Save\<close> apply (simp add: decode_cnode_invocation_def unlessE_whenE cong: if_cong) apply (rule hoare_pre) apply (wp ensure_empty_stronger whenE_throwError_wp
                lsfco_cte_at lookup_slot_for_cnode_op_cap_to
                hoare_vcg_const_imp_lift
                | simp add: split_beta
                | wp (once) hoare_drop_imps)+ apply clarsimp
    \<comment> \<open>CancelBadgedSends\<close> apply (simp add: decode_cnode_invocation_def
                     unlessE_def whenE_def
               split del: if_split) apply (wp get_cap_wp hoare_vcg_all_lift_R | simp add: )+ apply (rule_tac Q'="\<lambda>rv. invs and cte_wp_at (\<lambda>_. True) rv" in hoare_post_imp_R) apply (wp lsfco_cte_at) apply (clarsimp simp: cte_wp_valid_cap invs_valid_objs has_cancel_send_rights_ep_cap)+
   \<comment> \<open>Rotate\<close> apply (simp add: decode_cnode_invocation_def split_def
                    whenE_def unlessE_def) apply (rule hoare_pre) apply (wp get_cap_wp ensure_empty_stronger | simp)+ apply (rule_tac Q'="\<lambda>rv s. real_cte_at rv s \<and> real_cte_at x s
                              \<and> real_cte_at src_slot s
                              \<and> ex_cte_cap_wp_to is_cnode_cap rv s
                              \<and> ex_cte_cap_wp_to is_cnode_cap x s
                              \<and> invs s" in hoare_post_imp_R) apply wp+ apply (clarsimp simp: cte_wp_at_caps_of_state
                     dest!: real_cte_at_cte del: impI) apply (frule invs_valid_objs) apply (simp add: update_cap_data_validI weak_derived_update_cap_data
                       caps_of_state_valid_cap) subgoal by (auto,(clarsimp simp:is_cap_simps update_cap_data_def)+)[1] (* Bad practise *)
      apply wp+ apply clarsimp apply (elim disjE exE conjE,
         simp_all add: decode_cnode_invocation_def validE_R_def
                       split_def unlessE_whenE
                split: list.split_asm
            split del: if_split) apply (wp | simp)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<And>cap. \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller}\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 5. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 6. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 7. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
y <- ensure_empty dest_slot;
src_slot <- lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth);
src_cap <- liftE (get_cap src_slot);
y <- whenE (src_cap = NullCap) (throwError (FailedLookup True (MissingCapability (data_to_nat src_depth))));
(rights, cap_data, is_move) <- case gen_invocation_type mi of CNodeCopy \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | rightsWord # x \<Rightarrow> doE rights <- returnOk $ data_to_rights $ rightsWord;
returnOk $ (rights, None, False)
odE | CNodeMint \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | [rightsWord] \<Rightarrow> throwError TruncatedMessage | rightsWord # capData # xa \<Rightarrow> doE rights <- returnOk $ data_to_rights $ rightsWord;
returnOk $ (rights, Some capData, False)
odE | CNodeMove \<Rightarrow> returnOk (all_rights, None, True) | CNodeMutate \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | capData # x \<Rightarrow> returnOk (all_rights, Some capData, True) | _ \<Rightarrow> throwError TruncatedMessage;
new_cap <- (if is_move then returnOk else derive_cap src_slot) (case cap_data of None \<Rightarrow> mask_cap rights src_cap | Some w \<Rightarrow> update_cap_data is_move w (mask_cap rights src_cap));
y <- whenE (new_cap = NullCap) (throwError IllegalOperation);
returnOk ((if is_move then MoveCall else InsertCall) new_cap src_slot dest_slot)
odE \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 5. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 6. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 7. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (14 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot src_cap xa. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; \<not> snd (snd xa)\<rbrakk> \<Longrightarrow> \<lbrace>?R29 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot src_cap () xa\<rbrace> derive_cap src_slot (case fst (snd xa) of None \<Rightarrow> mask_cap (fst xa) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd xa)) w (mask_cap (fst xa) src_cap)) \<lbrace>\<lambda>new_cap s. new_cap \<noteq> NullCap \<longrightarrow> s \<turnstile> new_cap \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> cte_wp_at (is_derived (cdt s) src_slot new_cap) src_slot s \<and> cte_wp_at (\<lambda>c. c = NullCap) x s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> src_slot \<noteq> x \<and> (\<forall>r\<in>obj_refs new_cap. \<forall>a b. x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s \<and> \<not> is_zombie new_cap)\<rbrace>, -
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap ya. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B15 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap ya\<rbrace> case gen_invocation_type mi of CNodeCopy \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | rightsWord # x \<Rightarrow> doE rights <- returnOk $ data_to_rights $ rightsWord;
returnOk $ (rights, None, False)
odE | CNodeMint \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | [rightsWord] \<Rightarrow> throwError TruncatedMessage | rightsWord # capData # xa \<Rightarrow> doE rights <- returnOk $ data_to_rights $ rightsWord;
returnOk $ (rights, Some capData, False)
odE | CNodeMove \<Rightarrow> returnOk (all_rights, None, True) | CNodeMutate \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | capData # x \<Rightarrow> returnOk (all_rights, Some capData, True) | _ \<Rightarrow> throwError TruncatedMessage \<lbrace>\<lambda>a aa. True \<and> (snd (snd a) \<longrightarrow> (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<noteq> NullCap \<longrightarrow> valid_cnode_inv ((if snd (snd a) then MoveCall else InsertCall) (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) src_slot x) aa) \<and> (\<not> snd (snd a) \<longrightarrow> ?R29 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap ya a aa)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B14 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap\<rbrace> whenE (src_cap = NullCap) (throwError (FailedLookup True (MissingCapability (data_to_nat src_depth)))) \<lbrace>?B15 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B13 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot\<rbrace> liftE (get_cap src_slot) \<lbrace>?B14 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>?B13 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot src_cap xa. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; \<not> snd (snd xa)\<rbrakk> \<Longrightarrow> \<lbrace>?P39 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot src_cap () xa\<rbrace> derive_cap src_slot (case fst (snd xa) of None \<Rightarrow> mask_cap (fst xa) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd xa)) w (mask_cap (fst xa) src_cap)) \<lbrace>\<lambda>new_cap s. new_cap \<noteq> NullCap \<longrightarrow> s \<turnstile> new_cap \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> cte_wp_at (is_derived (cdt s) src_slot new_cap) src_slot s \<and> cte_wp_at (\<lambda>c. c = NullCap) x s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> src_slot \<noteq> x \<and> (\<forall>r\<in>obj_refs new_cap. \<forall>a b. x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s \<and> \<not> is_zombie new_cap)\<rbrace>, -
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap ya. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B15 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap ya\<rbrace> case gen_invocation_type mi of CNodeCopy \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | rightsWord # x \<Rightarrow> doE rights <- returnOk $ data_to_rights $ rightsWord;
returnOk $ (rights, None, False)
odE | CNodeMint \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | [rightsWord] \<Rightarrow> throwError TruncatedMessage | rightsWord # capData # xa \<Rightarrow> doE rights <- returnOk $ data_to_rights $ rightsWord;
returnOk $ (rights, Some capData, False)
odE | CNodeMove \<Rightarrow> returnOk (all_rights, None, True) | CNodeMutate \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | capData # x \<Rightarrow> returnOk (all_rights, Some capData, True) | _ \<Rightarrow> throwError TruncatedMessage \<lbrace>\<lambda>a aa. True \<and> (snd (snd a) \<longrightarrow> (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<noteq> NullCap \<longrightarrow> valid_cnode_inv ((if snd (snd a) then MoveCall else InsertCall) (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) src_slot x) aa) \<and> (\<not> snd (snd a) \<longrightarrow> (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<noteq> NullCap \<and> \<not> is_zombie (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<and> (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<noteq> IRQControlCap \<longrightarrow> ?P39 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap ya a aa)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B14 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap\<rbrace> whenE (src_cap = NullCap) (throwError (FailedLookup True (MissingCapability (data_to_nat src_depth)))) \<lbrace>?B15 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B13 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot\<rbrace> liftE (get_cap src_slot) \<lbrace>?B14 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>?B13 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot src_cap xa. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; \<not> snd (snd xa)\<rbrakk> \<Longrightarrow> \<lbrace>?P39 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot src_cap () xa\<rbrace> derive_cap src_slot (case fst (snd xa) of None \<Rightarrow> mask_cap (fst xa) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst xa) src_cap)) \<lbrace>\<lambda>new_cap s. (new_cap \<noteq> NullCap \<longrightarrow> s \<turnstile> new_cap) \<and> (new_cap \<noteq> NullCap \<longrightarrow> real_cte_at src_slot s) \<and> (new_cap \<noteq> NullCap \<longrightarrow> real_cte_at x s) \<and> (new_cap \<noteq> NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) src_slot new_cap) src_slot s) \<and> (new_cap \<noteq> NullCap \<longrightarrow> cte_wp_at (\<lambda>c. c = NullCap) x s) \<and> (new_cap \<noteq> NullCap \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap x s) \<and> (new_cap \<noteq> NullCap \<longrightarrow> src_slot \<noteq> x) \<and> (new_cap \<noteq> NullCap \<longrightarrow> (\<forall>r\<in>obj_refs new_cap. \<forall>a b. (x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s) \<and> (x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> \<not> is_zombie new_cap)))\<rbrace>, -
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap ya. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B15 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap ya\<rbrace> case gen_invocation_type mi of CNodeCopy \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | rightsWord # x \<Rightarrow> doE rights <- returnOk $ data_to_rights $ rightsWord;
returnOk $ (rights, None, False)
odE | CNodeMint \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | [rightsWord] \<Rightarrow> throwError TruncatedMessage | rightsWord # capData # xa \<Rightarrow> doE rights <- returnOk $ data_to_rights $ rightsWord;
returnOk $ (rights, Some capData, False)
odE | CNodeMove \<Rightarrow> returnOk (all_rights, None, True) | CNodeMutate \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | capData # x \<Rightarrow> returnOk (all_rights, Some capData, True) | _ \<Rightarrow> throwError TruncatedMessage \<lbrace>\<lambda>a aa. True \<and> (snd (snd a) \<longrightarrow> (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<noteq> NullCap \<longrightarrow> valid_cnode_inv ((if snd (snd a) then MoveCall else InsertCall) (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) src_slot x) aa) \<and> (\<not> snd (snd a) \<longrightarrow> (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<noteq> NullCap \<and> \<not> is_zombie (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<and> (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<noteq> IRQControlCap \<longrightarrow> ?P39 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap ya a aa)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B14 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap\<rbrace> whenE (src_cap = NullCap) (throwError (FailedLookup True (MissingCapability (data_to_nat src_depth)))) \<lbrace>?B15 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B13 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot\<rbrace> liftE (get_cap src_slot) \<lbrace>?B14 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>?B13 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap ya. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B15 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap ya\<rbrace> case gen_invocation_type mi of CNodeCopy \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | rightsWord # x \<Rightarrow> doE rights <- returnOk $ data_to_rights $ rightsWord;
returnOk $ (rights, None, False)
odE | CNodeMint \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | [rightsWord] \<Rightarrow> throwError TruncatedMessage | rightsWord # capData # xa \<Rightarrow> doE rights <- returnOk $ data_to_rights $ rightsWord;
returnOk $ (rights, Some capData, False)
odE | CNodeMove \<Rightarrow> returnOk (all_rights, None, True) | CNodeMutate \<Rightarrow> case drop 2 (src_index # src_depth # args') of [] \<Rightarrow> throwError TruncatedMessage | capData # x \<Rightarrow> returnOk (all_rights, Some capData, True) | _ \<Rightarrow> throwError TruncatedMessage \<lbrace>\<lambda>a aa. True \<and> (snd (snd a) \<longrightarrow> (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<noteq> NullCap \<longrightarrow> valid_cnode_inv ((if snd (snd a) then MoveCall else InsertCall) (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) src_slot x) aa) \<and> (\<not> snd (snd a) \<longrightarrow> (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<noteq> NullCap \<and> \<not> is_zombie (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<and> (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd a)) w (mask_cap (fst a) src_cap)) \<noteq> IRQControlCap \<longrightarrow> aa \<turnstile> (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap)) \<and> (\<not> is_zombie (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap)) \<longrightarrow> real_cte_at src_slot aa) \<and> (\<not> is_zombie (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap)) \<longrightarrow> real_cte_at x aa) \<and> ((case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap)) \<noteq> NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap)) \<and> (cap_badge cap, cap_badge (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap))) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap)) \<and> vs_cap_ref cap = vs_cap_ref (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap))) src_slot aa \<and> valid_objs aa) \<and> (\<not> is_zombie (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap)) \<longrightarrow> cte_wp_at (\<lambda>c. c = NullCap) x aa) \<and> (\<not> is_zombie (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap)) \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap x aa) \<and> (\<not> is_zombie (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap)) \<longrightarrow> src_slot \<noteq> x) \<and> (\<not> is_zombie (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap)) \<longrightarrow> (\<forall>r\<in>obj_refs (case fst (snd a) of None \<Rightarrow> mask_cap (fst a) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst a) src_cap)). \<forall>aaa b. (x \<noteq> (aaa, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (aaa, b) aa \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (aaa, b) aa) \<and> (x \<noteq> (aaa, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (aaa, b) aa \<longrightarrow> \<not> False))))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B14 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap\<rbrace> whenE (src_cap = NullCap) (throwError (FailedLookup True (MissingCapability (data_to_nat src_depth)))) \<lbrace>?B15 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot src_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B13 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot\<rbrace> liftE (get_cap src_slot) \<lbrace>?B14 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>?B13 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 13 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap s. src_cap \<noteq> NullCap \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (True \<and> (\<forall>xa xb. True \<and> (snd (snd (data_to_rights $ xa, None, False)) \<longrightarrow> (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (data_to_rights $ xa, None, False))) w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<noteq> NullCap \<longrightarrow> valid_cnode_inv ((if snd (snd (data_to_rights $ xa, None, False)) then MoveCall else InsertCall) (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (data_to_rights $ xa, None, False))) w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) src_slot x) s) \<and> (\<not> snd (snd (data_to_rights $ xa, None, False)) \<longrightarrow> (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (data_to_rights $ xa, None, False))) w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<noteq> NullCap \<and> \<not> is_zombie (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (data_to_rights $ xa, None, False))) w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<and> (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (data_to_rights $ xa, None, False))) w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<noteq> IRQControlCap \<longrightarrow> s \<turnstile> (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<and> (\<not> is_zombie (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<longrightarrow> real_cte_at src_slot s) \<and> (\<not> is_zombie (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<longrightarrow> real_cte_at x s) \<and> ((case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<noteq> NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<and> (cap_badge cap, cap_badge (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap))) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<and> vs_cap_ref cap = vs_cap_ref (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap))) src_slot s \<and> valid_objs s) \<and> (\<not> is_zombie (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<longrightarrow> cte_wp_at (\<lambda>c. c = NullCap) x s) \<and> (\<not> is_zombie (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap x s) \<and> (\<not> is_zombie (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<longrightarrow> src_slot \<noteq> x) \<and> (\<not> is_zombie (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)) \<longrightarrow> (\<forall>r\<in>obj_refs (case fst (snd (data_to_rights $ xa, None, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, None, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, None, False)) src_cap)). \<forall>a b. (x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s) \<and> (x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> \<not> False)))))) \<and> (True \<and> (\<forall>xa xb. True \<and> (\<forall>xb xc. True \<and> (snd (snd (data_to_rights $ xa, Some xb, False)) \<longrightarrow> (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (data_to_rights $ xa, Some xb, False))) w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<noteq> NullCap \<longrightarrow> valid_cnode_inv ((if snd (snd (data_to_rights $ xa, Some xb, False)) then MoveCall else InsertCall) (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (data_to_rights $ xa, Some xb, False))) w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) src_slot x) s) \<and> (\<not> snd (snd (data_to_rights $ xa, Some xb, False)) \<longrightarrow> (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (data_to_rights $ xa, Some xb, False))) w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<noteq> NullCap \<and> \<not> is_zombie (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (data_to_rights $ xa, Some xb, False))) w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<and> (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (data_to_rights $ xa, Some xb, False))) w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<noteq> IRQControlCap \<longrightarrow> s \<turnstile> (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<and> (\<not> is_zombie (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<longrightarrow> real_cte_at src_slot s) \<and> (\<not> is_zombie (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<longrightarrow> real_cte_at x s) \<and> ((case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<noteq> NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<and> (cap_badge cap, cap_badge (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap))) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<and> vs_cap_ref cap = vs_cap_ref (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap))) src_slot s \<and> valid_objs s) \<and> (\<not> is_zombie (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<longrightarrow> cte_wp_at (\<lambda>c. c = NullCap) x s) \<and> (\<not> is_zombie (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap x s) \<and> (\<not> is_zombie (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<longrightarrow> src_slot \<noteq> x) \<and> (\<not> is_zombie (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)) \<longrightarrow> (\<forall>r\<in>obj_refs (case fst (snd (data_to_rights $ xa, Some xb, False)) of None \<Rightarrow> mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (data_to_rights $ xa, Some xb, False)) src_cap)). \<forall>a b. (x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s) \<and> (x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> \<not> False))))))) \<and> ((snd (snd (all_rights, None, True)) \<longrightarrow> (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (all_rights, None, True))) w (mask_cap (fst (all_rights, None, True)) src_cap)) \<noteq> NullCap \<longrightarrow> valid_cnode_inv ((if snd (snd (all_rights, None, True)) then MoveCall else InsertCall) (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (all_rights, None, True))) w (mask_cap (fst (all_rights, None, True)) src_cap)) src_slot x) s) \<and> (\<not> snd (snd (all_rights, None, True)) \<longrightarrow> (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (all_rights, None, True))) w (mask_cap (fst (all_rights, None, True)) src_cap)) \<noteq> NullCap \<and> \<not> is_zombie (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (all_rights, None, True))) w (mask_cap (fst (all_rights, None, True)) src_cap)) \<and> (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (all_rights, None, True))) w (mask_cap (fst (all_rights, None, True)) src_cap)) \<noteq> IRQControlCap \<longrightarrow> s \<turnstile> (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap)) \<and> (\<not> is_zombie (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap)) \<longrightarrow> real_cte_at src_slot s) \<and> (\<not> is_zombie (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap)) \<longrightarrow> real_cte_at x s) \<and> ((case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap)) \<noteq> NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap)) \<and> (cap_badge cap, cap_badge (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap))) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap)) \<and> vs_cap_ref cap = vs_cap_ref (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap))) src_slot s \<and> valid_objs s) \<and> (\<not> is_zombie (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap)) \<longrightarrow> cte_wp_at (\<lambda>c. c = NullCap) x s) \<and> (\<not> is_zombie (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap)) \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap x s) \<and> (\<not> is_zombie (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap)) \<longrightarrow> src_slot \<noteq> x) \<and> (\<not> is_zombie (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap)) \<longrightarrow> (\<forall>r\<in>obj_refs (case fst (snd (all_rights, None, True)) of None \<Rightarrow> mask_cap (fst (all_rights, None, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, None, True)) src_cap)). \<forall>a b. (x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s) \<and> (x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> \<not> False))))) \<and> (True \<and> (\<forall>xa xb. (snd (snd (all_rights, Some xa, True)) \<longrightarrow> (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (all_rights, Some xa, True))) w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<noteq> NullCap \<longrightarrow> valid_cnode_inv ((if snd (snd (all_rights, Some xa, True)) then MoveCall else InsertCall) (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (all_rights, Some xa, True))) w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) src_slot x) s) \<and> (\<not> snd (snd (all_rights, Some xa, True)) \<longrightarrow> (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (all_rights, Some xa, True))) w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<noteq> NullCap \<and> \<not> is_zombie (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (all_rights, Some xa, True))) w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<and> (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data (snd (snd (all_rights, Some xa, True))) w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<noteq> IRQControlCap \<longrightarrow> s \<turnstile> (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<and> (\<not> is_zombie (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<longrightarrow> real_cte_at src_slot s) \<and> (\<not> is_zombie (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<longrightarrow> real_cte_at x s) \<and> ((case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<noteq> NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<and> (cap_badge cap, cap_badge (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap))) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<and> vs_cap_ref cap = vs_cap_ref (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap))) src_slot s \<and> valid_objs s) \<and> (\<not> is_zombie (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<longrightarrow> cte_wp_at (\<lambda>c. c = NullCap) x s) \<and> (\<not> is_zombie (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap x s) \<and> (\<not> is_zombie (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<longrightarrow> src_slot \<noteq> x) \<and> (\<not> is_zombie (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap)) \<longrightarrow> (\<forall>r\<in>obj_refs (case fst (snd (all_rights, Some xa, True)) of None \<Rightarrow> mask_cap (fst (all_rights, Some xa, True)) src_cap | Some w \<Rightarrow> update_cap_data False w (mask_cap (fst (all_rights, Some xa, True)) src_cap)). \<forall>a b. (x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s) \<and> (x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> \<not> False)))))) \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True\<rbrace>
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 6. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap s. src_cap \<noteq> NullCap \<longrightarrow> (\<forall>xa. \<not> is_zombie src_cap \<and> mask_cap (data_to_rights xa) src_cap \<noteq> IRQControlCap \<longrightarrow> s \<turnstile> mask_cap (data_to_rights xa) src_cap \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap src_cap \<and> (cap_badge cap, cap_badge src_cap) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid src_cap \<and> vs_cap_ref cap = vs_cap_ref src_cap) src_slot s \<and> valid_objs s \<and> cte_wp_at (\<lambda>c. c = NullCap) x s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> src_slot \<noteq> x \<and> (\<forall>r\<in>obj_refs src_cap. \<forall>a b. x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (\<lambda>a. \<not> is_zombie a) (a, b) s)) \<and> (\<forall>xa xb. update_cap_data False xb src_cap \<noteq> NullCap \<and> \<not> is_zombie src_cap \<and> update_cap_data False xb (mask_cap (data_to_rights xa) src_cap) \<noteq> IRQControlCap \<longrightarrow> s \<turnstile> update_cap_data False xb (mask_cap (data_to_rights xa) src_cap) \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap (update_cap_data False xb (mask_cap (data_to_rights xa) src_cap)) \<and> (cap_badge cap, cap_badge (update_cap_data False xb (mask_cap (data_to_rights xa) src_cap))) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid (update_cap_data False xb (mask_cap (data_to_rights xa) src_cap)) \<and> vs_cap_ref cap = vs_cap_ref src_cap) src_slot s \<and> valid_objs s \<and> cte_wp_at (\<lambda>c. c = NullCap) x s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> src_slot \<noteq> x \<and> (\<forall>r\<in>obj_refs (update_cap_data False xb (mask_cap (data_to_rights xa) src_cap)). \<forall>a b. x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (\<lambda>a. \<not> is_zombie a) (a, b) s)) \<and> s \<turnstile> mask_cap all_rights src_cap \<and> cte_wp_at ((=) NullCap) x s \<and> cte_wp_at ((\<noteq>) NullCap) src_slot s \<and> cte_wp_at (weak_derived (mask_cap all_rights src_cap)) src_slot s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = mask_cap all_rights src_cap) src_slot s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> (\<forall>xa. update_cap_data True xa src_cap \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True xa (mask_cap all_rights src_cap) \<and> cte_wp_at ((=) NullCap) x s \<and> cte_wp_at ((\<noteq>) NullCap) src_slot s \<and> cte_wp_at (weak_derived (update_cap_data True xa (mask_cap all_rights src_cap))) src_slot s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True xa (mask_cap all_rights src_cap)) src_slot s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> real_cte_at src_slot s \<and> real_cte_at x s)\<rbrace>
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 6. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (valid_cap rv and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = rv) src_slot and cte_wp_at ((=) NullCap) x) s\<rbrakk> \<Longrightarrow> rv \<noteq> NullCap \<longrightarrow> (\<forall>xa. \<not> is_zombie rv \<and> mask_cap (data_to_rights xa) rv \<noteq> IRQControlCap \<longrightarrow> s \<turnstile> mask_cap (data_to_rights xa) rv \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap rv \<and> (cap_badge cap, cap_badge rv) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid rv \<and> vs_cap_ref cap = vs_cap_ref rv) src_slot s \<and> valid_objs s \<and> cte_wp_at (\<lambda>c. c = NullCap) x s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> src_slot \<noteq> x \<and> (\<forall>r\<in>obj_refs rv. \<forall>a b. x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (\<lambda>a. \<not> is_zombie a) (a, b) s)) \<and> (\<forall>xa xb. update_cap_data False xb rv \<noteq> NullCap \<and> \<not> is_zombie rv \<and> update_cap_data False xb (mask_cap (data_to_rights xa) rv) \<noteq> IRQControlCap \<longrightarrow> s \<turnstile> update_cap_data False xb (mask_cap (data_to_rights xa) rv) \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap (update_cap_data False xb (mask_cap (data_to_rights xa) rv)) \<and> (cap_badge cap, cap_badge (update_cap_data False xb (mask_cap (data_to_rights xa) rv))) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid (update_cap_data False xb (mask_cap (data_to_rights xa) rv)) \<and> vs_cap_ref cap = vs_cap_ref rv) src_slot s \<and> valid_objs s \<and> cte_wp_at (\<lambda>c. c = NullCap) x s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> src_slot \<noteq> x \<and> (\<forall>r\<in>obj_refs (update_cap_data False xb (mask_cap (data_to_rights xa) rv)). \<forall>a b. x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (\<lambda>a. \<not> is_zombie a) (a, b) s)) \<and> s \<turnstile> mask_cap all_rights rv \<and> cte_wp_at ((=) NullCap) x s \<and> cte_wp_at ((\<noteq>) NullCap) src_slot s \<and> cte_wp_at (weak_derived (mask_cap all_rights rv)) src_slot s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = mask_cap all_rights rv) src_slot s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> (\<forall>xa. update_cap_data True xa rv \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True xa (mask_cap all_rights rv) \<and> cte_wp_at ((=) NullCap) x s \<and> cte_wp_at ((\<noteq>) NullCap) src_slot s \<and> cte_wp_at (weak_derived (update_cap_data True xa (mask_cap all_rights rv))) src_slot s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True xa (mask_cap all_rights rv)) src_slot s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> real_cte_at src_slot s \<and> real_cte_at x s)
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (valid_cap rv and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = rv) src_slot and cte_wp_at ((=) NullCap) x) s\<rbrakk> \<Longrightarrow> rv \<noteq> NullCap \<longrightarrow> (\<forall>xa. \<not> is_zombie rv \<and> mask_cap (data_to_rights xa) rv \<noteq> IRQControlCap \<longrightarrow> s \<turnstile> mask_cap (data_to_rights xa) rv \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap rv \<and> (cap_badge cap, cap_badge rv) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid rv \<and> vs_cap_ref cap = vs_cap_ref rv) src_slot s \<and> valid_objs s \<and> cte_wp_at (\<lambda>c. c = NullCap) x s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> src_slot \<noteq> x \<and> (\<forall>r\<in>obj_refs rv. \<forall>a b. x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (\<lambda>a. \<not> is_zombie a) (a, b) s)) \<and> (\<forall>xa xb. update_cap_data False xb rv \<noteq> NullCap \<and> \<not> is_zombie rv \<and> update_cap_data False xb (mask_cap (data_to_rights xa) rv) \<noteq> IRQControlCap \<longrightarrow> s \<turnstile> update_cap_data False xb (mask_cap (data_to_rights xa) rv) \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap (update_cap_data False xb (mask_cap (data_to_rights xa) rv)) \<and> (cap_badge cap, cap_badge (update_cap_data False xb (mask_cap (data_to_rights xa) rv))) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid (update_cap_data False xb (mask_cap (data_to_rights xa) rv)) \<and> vs_cap_ref cap = vs_cap_ref rv) src_slot s \<and> valid_objs s \<and> cte_wp_at (\<lambda>c. c = NullCap) x s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> src_slot \<noteq> x \<and> (\<forall>r\<in>obj_refs (update_cap_data False xb (mask_cap (data_to_rights xa) rv)). \<forall>a b. x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (\<lambda>a. \<not> is_zombie a) (a, b) s)) \<and> s \<turnstile> mask_cap all_rights rv \<and> cte_wp_at ((=) NullCap) x s \<and> cte_wp_at ((\<noteq>) NullCap) src_slot s \<and> cte_wp_at (weak_derived (mask_cap all_rights rv)) src_slot s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = mask_cap all_rights rv) src_slot s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> (\<forall>xa. update_cap_data True xa rv \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True xa (mask_cap all_rights rv) \<and> cte_wp_at ((=) NullCap) x s \<and> cte_wp_at ((\<noteq>) NullCap) src_slot s \<and> cte_wp_at (weak_derived (update_cap_data True xa (mask_cap all_rights rv))) src_slot s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True xa (mask_cap all_rights rv)) src_slot s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> real_cte_at src_slot s \<and> real_cte_at x s)
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' a b aa ba rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke; s \<turnstile> rv; gen_invocation_type mi \<noteq> CNodeDelete; ex_cte_cap_wp_to is_cnode_cap (a, b) s; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; zombies_final s; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; valid_objs s; cap_table_at (length ba) aa s; cap_table_at (length b) a s; caps_of_state s (aa, ba) = Some rv; caps_of_state s (a, b) = Some NullCap; rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> (\<not> is_zombie rv \<and> (\<exists>x. mask_cap (data_to_rights x) rv \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> (\<forall>x xa. update_cap_data False xa rv \<noteq> NullCap \<and> \<not> is_zombie rv \<and> update_cap_data False xa (mask_cap (data_to_rights x) rv) \<noteq> IRQControlCap \<longrightarrow> s \<turnstile> update_cap_data False xa (mask_cap (data_to_rights x) rv) \<and> cap_master_cap rv = cap_master_cap (update_cap_data False xa (mask_cap (data_to_rights x) rv)) \<and> (cap_badge rv, cap_badge (update_cap_data False xa (mask_cap (data_to_rights x) rv))) \<in> capBadge_ordering False \<and> cap_asid rv = cap_asid (update_cap_data False xa (mask_cap (data_to_rights x) rv)) \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs (update_cap_data False xa (mask_cap (data_to_rights x) rv)). \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> weak_derived (mask_cap UNIV rv) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = mask_cap UNIV rv) \<and> (\<forall>x. update_cap_data True x rv \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True x (mask_cap UNIV rv) \<and> weak_derived (update_cap_data True x (mask_cap UNIV rv)) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = update_cap_data True x (mask_cap UNIV rv)))
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' a b aa ba rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke; s \<turnstile> rv; gen_invocation_type mi \<noteq> CNodeDelete; ex_cte_cap_wp_to is_cnode_cap (a, b) s; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; zombies_final s; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; valid_objs s; cap_table_at (length ba) aa s; cap_table_at (length b) a s; caps_of_state s (aa, ba) = Some rv; caps_of_state s (a, b) = Some NullCap; rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> (\<not> is_zombie rv \<and> (\<exists>x. mask_cap (data_to_rights x) rv \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> (\<forall>x xa. update_cap_data False xa rv \<noteq> NullCap \<and> \<not> is_zombie rv \<and> update_cap_data False xa (mask_cap (data_to_rights x) rv) \<noteq> IRQControlCap \<longrightarrow> (cap_badge rv, cap_badge (update_cap_data False xa (mask_cap (data_to_rights x) rv))) \<in> capBadge_ordering False \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> weak_derived (mask_cap UNIV rv) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = mask_cap UNIV rv) \<and> (\<forall>x. update_cap_data True x rv \<noteq> NullCap \<longrightarrow> weak_derived (update_cap_data True x (mask_cap UNIV rv)) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = update_cap_data True x (mask_cap UNIV rv)))
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' a b aa ba rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke; s \<turnstile> rv; gen_invocation_type mi \<noteq> CNodeDelete; ex_cte_cap_wp_to is_cnode_cap (a, b) s; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; zombies_final s; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; valid_objs s; cap_table_at (length ba) aa s; cap_table_at (length b) a s; caps_of_state s (aa, ba) = Some rv; caps_of_state s (a, b) = Some NullCap; rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> (\<not> is_zombie rv \<and> (\<exists>x. mask_cap (data_to_rights x) rv \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> (\<forall>x xa. update_cap_data False xa rv \<noteq> NullCap \<and> \<not> is_zombie rv \<and> update_cap_data False xa (mask_cap (data_to_rights x) rv) \<noteq> IRQControlCap \<longrightarrow> (update_cap_data False xa (mask_cap (data_to_rights x) rv) \<noteq> NullCap \<and> (cap_badge rv, cap_badge (mask_cap (data_to_rights x) rv)) \<in> capBadge_ordering False) \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> weak_derived (mask_cap UNIV rv) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = mask_cap UNIV rv) \<and> (\<forall>x. update_cap_data True x rv \<noteq> NullCap \<longrightarrow> weak_derived (update_cap_data True x (mask_cap UNIV rv)) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = update_cap_data True x (mask_cap UNIV rv)))
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' a b aa ba rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke; s \<turnstile> rv; gen_invocation_type mi \<noteq> CNodeDelete; ex_cte_cap_wp_to is_cnode_cap (a, b) s; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; zombies_final s; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; valid_objs s; cap_table_at (length ba) aa s; cap_table_at (length b) a s; caps_of_state s (aa, ba) = Some rv; caps_of_state s (a, b) = Some NullCap; rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> (\<not> is_zombie rv \<and> (\<exists>x. mask_cap (data_to_rights x) rv \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> ((\<exists>x xa. update_cap_data False xa rv \<noteq> NullCap \<and> \<not> is_zombie rv \<and> update_cap_data False xa (mask_cap (data_to_rights x) rv) \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> weak_derived (mask_cap UNIV rv) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = mask_cap UNIV rv) \<and> (\<forall>x. update_cap_data True x rv \<noteq> NullCap \<longrightarrow> weak_derived (update_cap_data True x (mask_cap UNIV rv)) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = update_cap_data True x (mask_cap UNIV rv)))
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' a b aa ba rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke; s \<turnstile> rv; gen_invocation_type mi \<noteq> CNodeDelete; ex_cte_cap_wp_to is_cnode_cap (a, b) s; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; zombies_final s; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; valid_objs s; cap_table_at (length ba) aa s; cap_table_at (length b) a s; caps_of_state s (aa, ba) = Some rv; caps_of_state s (a, b) = Some NullCap; rv \<noteq> NullCap; s \<turnstile> rv\<rbrakk> \<Longrightarrow> (\<not> is_zombie rv \<and> (\<exists>x. mask_cap (data_to_rights x) rv \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> ((\<exists>x xa. update_cap_data False xa rv \<noteq> NullCap \<and> \<not> is_zombie rv \<and> update_cap_data False xa (mask_cap (data_to_rights x) rv) \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> weak_derived (mask_cap UNIV rv) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = mask_cap UNIV rv) \<and> (\<forall>x. update_cap_data True x rv \<noteq> NullCap \<longrightarrow> weak_derived (update_cap_data True x (mask_cap UNIV rv)) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = update_cap_data True x (mask_cap UNIV rv)))
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' a b aa ba rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke; s \<turnstile> rv; gen_invocation_type mi \<noteq> CNodeDelete; ex_cte_cap_wp_to is_cnode_cap (a, b) s; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; zombies_final s; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; valid_objs s; cap_table_at (length ba) aa s; cap_table_at (length b) a s; caps_of_state s (aa, ba) = Some rv; caps_of_state s (a, b) = Some NullCap; rv \<noteq> NullCap; s \<turnstile> rv; is_zombie rv\<rbrakk> \<Longrightarrow> (\<not> is_zombie rv \<and> (\<exists>x. mask_cap (data_to_rights x) rv \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> ((\<exists>x xa. update_cap_data False xa rv \<noteq> NullCap \<and> \<not> is_zombie rv \<and> update_cap_data False xa (mask_cap (data_to_rights x) rv) \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> weak_derived (mask_cap UNIV rv) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = mask_cap UNIV rv) \<and> (\<forall>x. update_cap_data True x rv \<noteq> NullCap \<longrightarrow> weak_derived (update_cap_data True x (mask_cap UNIV rv)) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = update_cap_data True x (mask_cap UNIV rv)))
 2. \<And>index bits src_index src_depth args' src_root_cap exs' a b aa ba rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke; s \<turnstile> rv; gen_invocation_type mi \<noteq> CNodeDelete; ex_cte_cap_wp_to is_cnode_cap (a, b) s; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; zombies_final s; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; valid_objs s; cap_table_at (length ba) aa s; cap_table_at (length b) a s; caps_of_state s (aa, ba) = Some rv; caps_of_state s (a, b) = Some NullCap; rv \<noteq> NullCap; s \<turnstile> rv; \<not> is_zombie rv\<rbrakk> \<Longrightarrow> (\<not> is_zombie rv \<and> (\<exists>x. mask_cap (data_to_rights x) rv \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> ((\<exists>x xa. update_cap_data False xa rv \<noteq> NullCap \<and> \<not> is_zombie rv \<and> update_cap_data False xa (mask_cap (data_to_rights x) rv) \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> weak_derived (mask_cap UNIV rv) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = mask_cap UNIV rv) \<and> (\<forall>x. update_cap_data True x rv \<noteq> NullCap \<longrightarrow> weak_derived (update_cap_data True x (mask_cap UNIV rv)) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = update_cap_data True x (mask_cap UNIV rv)))
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' a b aa ba rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke; s \<turnstile> rv; gen_invocation_type mi \<noteq> CNodeDelete; ex_cte_cap_wp_to is_cnode_cap (a, b) s; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; zombies_final s; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; valid_objs s; cap_table_at (length ba) aa s; cap_table_at (length b) a s; caps_of_state s (aa, ba) = Some rv; caps_of_state s (a, b) = Some NullCap; rv \<noteq> NullCap; s \<turnstile> rv; \<not> is_zombie rv\<rbrakk> \<Longrightarrow> (\<not> is_zombie rv \<and> (\<exists>x. mask_cap (data_to_rights x) rv \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> ((\<exists>x xa. update_cap_data False xa rv \<noteq> NullCap \<and> \<not> is_zombie rv \<and> update_cap_data False xa (mask_cap (data_to_rights x) rv) \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> weak_derived (mask_cap UNIV rv) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = mask_cap UNIV rv) \<and> (\<forall>x. update_cap_data True x rv \<noteq> NullCap \<longrightarrow> weak_derived (update_cap_data True x (mask_cap UNIV rv)) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = update_cap_data True x (mask_cap UNIV rv)))
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' a b aa ba rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke; s \<turnstile> rv; gen_invocation_type mi \<noteq> CNodeDelete; ex_cte_cap_wp_to is_cnode_cap (a, b) s; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; zombies_final s; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; valid_objs s; cap_table_at (length ba) aa s; cap_table_at (length b) a s; caps_of_state s (aa, ba) = Some rv; caps_of_state s (a, b) = Some NullCap; rv \<noteq> NullCap; s \<turnstile> rv; \<not> is_zombie rv; \<forall>r\<in>obj_refs rv. \<forall>a b. cte_wp_at (\<lambda>cap'. r \<in> obj_refs cap') (a, b) s \<longrightarrow> cte_wp_at (Not \<circ> is_zombie) (a, b) s\<rbrakk> \<Longrightarrow> (\<not> is_zombie rv \<and> (\<exists>x. mask_cap (data_to_rights x) rv \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> ((\<exists>x xa. update_cap_data False xa rv \<noteq> NullCap \<and> \<not> is_zombie rv \<and> update_cap_data False xa (mask_cap (data_to_rights x) rv) \<noteq> IRQControlCap) \<longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>r\<in>obj_refs rv. \<forall>aa ba. (a = aa \<longrightarrow> b \<noteq> ba) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> \<not> is_zombie cap))) \<and> weak_derived (mask_cap UNIV rv) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = mask_cap UNIV rv) \<and> (\<forall>x. update_cap_data True x rv \<noteq> NullCap \<longrightarrow> weak_derived (update_cap_data True x (mask_cap UNIV rv)) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = update_cap_data True x (mask_cap UNIV rv)))
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' a b aa ba rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke; gen_invocation_type mi \<noteq> CNodeDelete; ex_cte_cap_wp_to is_cnode_cap (a, b) s; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; zombies_final s; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; valid_objs s; cap_table_at (length ba) aa s; cap_table_at (length b) a s; caps_of_state s (aa, ba) = Some rv; caps_of_state s (a, b) = Some NullCap; rv \<noteq> NullCap; \<not> is_zombie rv; \<forall>r\<in>obj_refs rv. \<forall>a b. (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> \<not> is_zombie cap); cap_aligned rv; wellformed_cap rv; valid_cap_ref rv s\<rbrakk> \<Longrightarrow> ((\<exists>x. mask_cap (data_to_rights x) rv \<noteq> IRQControlCap) \<longrightarrow> aa = a \<longrightarrow> ba \<noteq> b) \<and> ((\<exists>x xa. update_cap_data False xa rv \<noteq> NullCap \<and> update_cap_data False xa (mask_cap (data_to_rights x) rv) \<noteq> IRQControlCap) \<longrightarrow> aa = a \<longrightarrow> ba \<noteq> b) \<and> (\<forall>x. update_cap_data True x rv \<noteq> NullCap \<longrightarrow> weak_derived (update_cap_data True x rv) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = update_cap_data True x rv))
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' a b aa ba rv s x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke; gen_invocation_type mi \<noteq> CNodeDelete; ex_cte_cap_wp_to is_cnode_cap (a, b) s; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; zombies_final s; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; valid_objs s; cap_table_at (length ba) aa s; cap_table_at (length b) a s; caps_of_state s (aa, ba) = Some rv; caps_of_state s (a, b) = Some NullCap; rv \<noteq> NullCap; \<not> is_zombie rv; \<forall>r\<in>obj_refs rv. \<forall>a b. (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> r \<in> obj_refs cap) \<longrightarrow> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> \<not> is_zombie cap); cap_aligned rv; wellformed_cap rv; valid_cap_ref rv s; update_cap_data True x rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> weak_derived (update_cap_data True x rv) rv \<and> (is_untyped_cap rv \<longrightarrow> rv = update_cap_data True x rv)
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'369 cap index bits src_index src_depth args' src_root_cap exs' x () src_slot\<rbrace> get_cap src_slot \<lbrace>\<lambda>src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x and zombies_final and valid_objs and real_cte_at src_slot and real_cte_at x and cte_wp_at (\<lambda>c. c = src_cap) src_slot and cte_wp_at ((=) NullCap) x\<rbrace>
 2. \<And>cap index bits src_index src_depth args' src_root_cap exs' x y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x y\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> ?P'369 cap index bits src_index src_depth args' src_root_cap exs' x y src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits src_index src_depth args' src_root_cap exs' x. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace> ensure_empty x \<lbrace>?B12 cap index bits src_index src_depth args' src_root_cap exs' x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'10 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B11 cap index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'10 cap index bits src_index src_depth args' src_root_cap exs' s
 6. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 7. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 8. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 9. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 10. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> True \<and> True \<and> valid_objs s \<and> ((is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> zombies_final s \<and> valid_objs s \<and> (valid_objs and valid_cap src_root_cap) s \<and> (valid_objs and valid_cap cap) s \<and> True \<and> True
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 5. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 6. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 7. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>cap index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<noteq> CNodeRevoke \<and> gen_invocation_type mi \<noteq> CNodeDelete \<and> gen_invocation_type mi \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type mi \<noteq> CNodeRotate \<and> gen_invocation_type mi \<noteq> CNodeSaveCaller; invs s \<and> s \<turnstile> cap \<and> (\<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) \<and> (is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrakk> \<Longrightarrow> valid_objs s \<and> zombies_final s \<and> valid_objs s
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 5. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 6. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 7. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 5. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 6. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
returnOk (RevokeCall dest_slot)
odE \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 5. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 6. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>cap index bits args' s. \<lbrakk>args = index # bits # args'; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRevoke; invs s \<and> s \<turnstile> cap \<and> (\<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) \<and> (is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set cs. s \<turnstile> cap) \<and> (\<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 5. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 6. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 5. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
returnOk (DeleteCall dest_slot)
odE \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 5. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>cap index bits args' s. \<lbrakk>args = index # bits # args'; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeDelete; invs s \<and> s \<turnstile> cap \<and> (\<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) \<and> (is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set cs. s \<turnstile> cap) \<and> (\<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 5. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
y <- ensure_empty dest_slot;
returnOk (SaveCall dest_slot)
odE \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'637 cap index bits args'\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
y <- ensure_empty dest_slot;
returnOk (SaveCall dest_slot)
odE \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap index bits args' s. \<lbrakk>args = index # bits # args'; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))) s\<rbrakk> \<Longrightarrow> ?P'637 cap index bits args' s
 3. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 5. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>cap index bits args' s. \<lbrakk>args = index # bits # args'; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeSaveCaller; invs s \<and> s \<turnstile> cap \<and> (\<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) \<and> (is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set cs. s \<turnstile> cap) \<and> (\<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>cap index bits args'. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
cap <- liftE (get_cap dest_slot);
y <- if has_cancel_send_rights cap then returnOk () else throwError IllegalOperation;
returnOk (CancelBadgedSendsCall cap)
odE \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 3. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>cap index bits args' capa. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>?P686 cap index bits args' capa\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>\<lambda>rv s. cte_wp_at ((=) capa) rv s \<longrightarrow> has_cancel_send_rights capa \<longrightarrow> s \<turnstile> capa\<rbrace>, -
 2. \<And>cap index bits args' s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> (\<forall>x. ?P686 cap index bits args' x s)
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>cap index bits args' capa. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>?P686 cap index bits args' capa\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>\<lambda>rv. invs and cte_wp_at (\<lambda>_. True) rv\<rbrace>, -
 2. \<And>cap index bits args' capa rv s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends; (invs and cte_wp_at (\<lambda>_. True) rv) s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) rv s \<longrightarrow> has_cancel_send_rights capa \<longrightarrow> s \<turnstile> capa
 3. \<And>cap index bits args' s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> (\<forall>x. ?P686 cap index bits args' x s)
 4. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 5. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>cap index bits args' capa rv s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends; (invs and cte_wp_at (\<lambda>_. True) rv) s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) rv s \<longrightarrow> has_cancel_send_rights capa \<longrightarrow> s \<turnstile> capa
 2. \<And>cap index bits args' s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeCancelBadgedSends; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> (\<forall>x. invs s \<and> (valid_objs and valid_cap cap) s)
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, -
 4. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> pivot_root_cap \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))\<rbrace> decode_cnode_invocation mi (index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args') cap (pivot_root_cap # src_root_cap # exs') \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> pivot_root_cap \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
src_slot <- lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth);
pivot_slot <- lookup_slot_for_cnode_op True pivot_root_cap (data_to_cptr pivot_index) (data_to_nat pivot_depth);
y <- if pivot_slot = src_slot \<or> pivot_slot = dest_slot then throwError IllegalOperation else returnOk ();
y <- if src_slot = dest_slot then returnOk () else ensure_empty dest_slot;
src_cap <- liftE (get_cap src_slot);
y <- if src_cap = NullCap then throwError (FailedLookup True (MissingCapability (data_to_nat src_depth))) else returnOk ();
pivot_cap <- liftE (get_cap pivot_slot);
y <- if pivot_cap = NullCap then throwError (FailedLookup False (MissingCapability (data_to_nat pivot_depth))) else returnOk ();
y <- if update_cap_data True src_new_data src_cap = NullCap then throwError IllegalOperation else returnOk ();
y <- if update_cap_data True pivot_new_data pivot_cap = NullCap then throwError IllegalOperation else returnOk ();
returnOk (RotateCall (update_cap_data True src_new_data src_cap) (update_cap_data True pivot_new_data pivot_cap) src_slot pivot_slot dest_slot)
odE \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
src_slot <- lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth);
pivot_slot <- lookup_slot_for_cnode_op True pivot_root_cap (data_to_cptr pivot_index) (data_to_nat pivot_depth);
y <- if pivot_slot = src_slot \<or> pivot_slot = dest_slot then throwError IllegalOperation else returnOk ();
y <- if src_slot = dest_slot then returnOk () else ensure_empty dest_slot;
src_cap <- liftE (get_cap src_slot);
y <- if src_cap = NullCap then throwError (FailedLookup True (MissingCapability (data_to_nat src_depth))) else returnOk ();
pivot_cap <- liftE (get_cap pivot_slot);
y <- if pivot_cap = NullCap then throwError (FailedLookup False (MissingCapability (data_to_nat pivot_depth))) else returnOk ();
y <- if update_cap_data True src_new_data src_cap = NullCap then throwError IllegalOperation else returnOk ();
y <- if update_cap_data True pivot_new_data pivot_cap = NullCap then throwError IllegalOperation else returnOk ();
returnOk (RotateCall (update_cap_data True src_new_data src_cap) (update_cap_data True pivot_new_data pivot_cap) src_slot pivot_slot dest_slot)
odE \<lbrace>valid_cnode_inv\<rbrace>, -
 2. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> pivot_root_cap \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 3. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'792 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x src_slot\<rbrace> lookup_slot_for_cnode_op True pivot_root_cap (data_to_cptr pivot_index) (data_to_nat pivot_depth) \<lbrace>\<lambda>rv s. rv \<noteq> src_slot \<and> rv \<noteq> x \<longrightarrow> (src_slot = x \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) x s \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> (\<forall>capa. cte_wp_at ((=) capa) rv s \<longrightarrow> capa \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data cap \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data capa \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True src_new_data cap \<and> s \<turnstile> update_cap_data True pivot_new_data capa \<and> real_cte_at x s \<and> real_cte_at rv s \<and> cte_wp_at (weak_derived (update_cap_data True src_new_data cap)) x s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True src_new_data cap) x s \<and> cte_wp_at ((\<noteq>) NullCap) x s \<and> cte_wp_at (weak_derived (update_cap_data True pivot_new_data capa)) rv s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True pivot_new_data capa) rv s \<and> cte_wp_at ((\<noteq>) NullCap) rv s \<and> x \<noteq> rv \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> ex_cte_cap_wp_to is_cnode_cap x s))) \<and> (src_slot \<noteq> x \<longrightarrow> cte_wp_at (\<lambda>c. c = NullCap) x s \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) src_slot s \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> (\<forall>capa. cte_wp_at ((=) capa) rv s \<longrightarrow> capa \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data cap \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data capa \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True src_new_data cap \<and> s \<turnstile> update_cap_data True pivot_new_data capa \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> real_cte_at rv s \<and> cte_wp_at (weak_derived (update_cap_data True src_new_data cap)) src_slot s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True src_new_data cap) src_slot s \<and> cte_wp_at ((\<noteq>) NullCap) src_slot s \<and> cte_wp_at (weak_derived (update_cap_data True pivot_new_data capa)) rv s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True pivot_new_data capa) rv s \<and> cte_wp_at ((\<noteq>) NullCap) rv s \<and> src_slot \<noteq> rv \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> ex_cte_cap_wp_to is_cnode_cap x s)))\<rbrace>, -
 2. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> True \<and> True \<and> True \<and> ?P'792 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> pivot_root_cap \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 5. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x src_slot. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'792 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x src_slot\<rbrace> lookup_slot_for_cnode_op True pivot_root_cap (data_to_cptr pivot_index) (data_to_nat pivot_depth) \<lbrace>\<lambda>rv s. real_cte_at rv s \<and> real_cte_at x s \<and> real_cte_at src_slot s \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> invs s\<rbrace>, -
 2. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x src_slot rv s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; real_cte_at rv s \<and> real_cte_at x s \<and> real_cte_at src_slot s \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> invs s\<rbrakk> \<Longrightarrow> rv \<noteq> src_slot \<and> rv \<noteq> x \<longrightarrow> (src_slot = x \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) x s \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> (\<forall>capa. cte_wp_at ((=) capa) rv s \<longrightarrow> capa \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data cap \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data capa \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True src_new_data cap \<and> s \<turnstile> update_cap_data True pivot_new_data capa \<and> real_cte_at x s \<and> real_cte_at rv s \<and> cte_wp_at (weak_derived (update_cap_data True src_new_data cap)) x s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True src_new_data cap) x s \<and> cte_wp_at ((\<noteq>) NullCap) x s \<and> cte_wp_at (weak_derived (update_cap_data True pivot_new_data capa)) rv s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True pivot_new_data capa) rv s \<and> cte_wp_at ((\<noteq>) NullCap) rv s \<and> x \<noteq> rv \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> ex_cte_cap_wp_to is_cnode_cap x s))) \<and> (src_slot \<noteq> x \<longrightarrow> cte_wp_at (\<lambda>c. c = NullCap) x s \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) src_slot s \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> (\<forall>capa. cte_wp_at ((=) capa) rv s \<longrightarrow> capa \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data cap \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data capa \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True src_new_data cap \<and> s \<turnstile> update_cap_data True pivot_new_data capa \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> real_cte_at rv s \<and> cte_wp_at (weak_derived (update_cap_data True src_new_data cap)) src_slot s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True src_new_data cap) src_slot s \<and> cte_wp_at ((\<noteq>) NullCap) src_slot s \<and> cte_wp_at (weak_derived (update_cap_data True pivot_new_data capa)) rv s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True pivot_new_data capa) rv s \<and> cte_wp_at ((\<noteq>) NullCap) rv s \<and> src_slot \<noteq> rv \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> ex_cte_cap_wp_to is_cnode_cap x s)))
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> True \<and> True \<and> True \<and> ?P'792 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x src_slot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> pivot_root_cap \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 6. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x src_slot rv s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; real_cte_at rv s \<and> real_cte_at x s \<and> real_cte_at src_slot s \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> invs s\<rbrakk> \<Longrightarrow> rv \<noteq> src_slot \<and> rv \<noteq> x \<longrightarrow> (src_slot = x \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) x s \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> (\<forall>capa. cte_wp_at ((=) capa) rv s \<longrightarrow> capa \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data cap \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data capa \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True src_new_data cap \<and> s \<turnstile> update_cap_data True pivot_new_data capa \<and> real_cte_at x s \<and> real_cte_at rv s \<and> cte_wp_at (weak_derived (update_cap_data True src_new_data cap)) x s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True src_new_data cap) x s \<and> cte_wp_at ((\<noteq>) NullCap) x s \<and> cte_wp_at (weak_derived (update_cap_data True pivot_new_data capa)) rv s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True pivot_new_data capa) rv s \<and> cte_wp_at ((\<noteq>) NullCap) rv s \<and> x \<noteq> rv \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> ex_cte_cap_wp_to is_cnode_cap x s))) \<and> (src_slot \<noteq> x \<longrightarrow> cte_wp_at (\<lambda>c. c = NullCap) x s \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) src_slot s \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> (\<forall>capa. cte_wp_at ((=) capa) rv s \<longrightarrow> capa \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data cap \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data capa \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True src_new_data cap \<and> s \<turnstile> update_cap_data True pivot_new_data capa \<and> real_cte_at src_slot s \<and> real_cte_at x s \<and> real_cte_at rv s \<and> cte_wp_at (weak_derived (update_cap_data True src_new_data cap)) src_slot s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True src_new_data cap) src_slot s \<and> cte_wp_at ((\<noteq>) NullCap) src_slot s \<and> cte_wp_at (weak_derived (update_cap_data True pivot_new_data capa)) rv s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<longrightarrow> c = update_cap_data True pivot_new_data capa) rv s \<and> cte_wp_at ((\<noteq>) NullCap) rv s \<and> src_slot \<noteq> rv \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> ex_cte_cap_wp_to is_cnode_cap x s)))
 2. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> True \<and> True \<and> True \<and> (valid_objs and valid_cap pivot_root_cap) s \<and> real_cte_at x s \<and> real_cte_at src_slot s \<and> ((is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> invs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> pivot_root_cap \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 5. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' a b aa ba ab bb s cap capa capb. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; invs s; caps_of_state s (ab, bb) = Some cap; caps_of_state s (a, b) = Some capa; caps_of_state s (aa, ba) = Some capb\<rbrakk> \<Longrightarrow> (ab = aa \<longrightarrow> bb \<noteq> ba) \<and> (ab = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> (aa = a \<and> ba = b \<longrightarrow> capa \<noteq> NullCap \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data capa \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data cap \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True src_new_data capa \<and> s \<turnstile> update_cap_data True pivot_new_data cap \<and> weak_derived (update_cap_data True src_new_data capa) capa \<and> (is_untyped_cap capa \<longrightarrow> capa = update_cap_data True src_new_data capa) \<and> weak_derived (update_cap_data True pivot_new_data cap) cap \<and> (is_untyped_cap cap \<longrightarrow> cap = update_cap_data True pivot_new_data cap) \<and> (a = ab \<longrightarrow> b \<noteq> bb)) \<and> ((aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> capa = NullCap \<longrightarrow> capb \<noteq> NullCap \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data capb \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data cap \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True src_new_data capb \<and> s \<turnstile> update_cap_data True pivot_new_data cap \<and> weak_derived (update_cap_data True src_new_data capb) capb \<and> (is_untyped_cap capb \<longrightarrow> capb = update_cap_data True src_new_data capb) \<and> weak_derived (update_cap_data True pivot_new_data cap) cap \<and> (is_untyped_cap cap \<longrightarrow> cap = update_cap_data True pivot_new_data cap) \<and> (aa = ab \<longrightarrow> ba \<noteq> bb))
 2. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> True \<and> True \<and> True \<and> (valid_objs and valid_cap pivot_root_cap) s \<and> real_cte_at x s \<and> real_cte_at src_slot s \<and> ((is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> invs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> pivot_root_cap \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 5. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' a b aa ba ab bb s cap capa capb. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; invs s; caps_of_state s (ab, bb) = Some cap; caps_of_state s (a, b) = Some capa; caps_of_state s (aa, ba) = Some capb; valid_objs s\<rbrakk> \<Longrightarrow> (ab = aa \<longrightarrow> bb \<noteq> ba) \<and> (ab = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> (aa = a \<and> ba = b \<longrightarrow> capa \<noteq> NullCap \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data capa \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data cap \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True src_new_data capa \<and> s \<turnstile> update_cap_data True pivot_new_data cap \<and> weak_derived (update_cap_data True src_new_data capa) capa \<and> (is_untyped_cap capa \<longrightarrow> capa = update_cap_data True src_new_data capa) \<and> weak_derived (update_cap_data True pivot_new_data cap) cap \<and> (is_untyped_cap cap \<longrightarrow> cap = update_cap_data True pivot_new_data cap) \<and> (a = ab \<longrightarrow> b \<noteq> bb)) \<and> ((aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> capa = NullCap \<longrightarrow> capb \<noteq> NullCap \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data capb \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data cap \<noteq> NullCap \<longrightarrow> s \<turnstile> update_cap_data True src_new_data capb \<and> s \<turnstile> update_cap_data True pivot_new_data cap \<and> weak_derived (update_cap_data True src_new_data capb) capb \<and> (is_untyped_cap capb \<longrightarrow> capb = update_cap_data True src_new_data capb) \<and> weak_derived (update_cap_data True pivot_new_data cap) cap \<and> (is_untyped_cap cap \<longrightarrow> cap = update_cap_data True pivot_new_data cap) \<and> (aa = ab \<longrightarrow> ba \<noteq> bb))
 2. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> True \<and> True \<and> True \<and> (valid_objs and valid_cap pivot_root_cap) s \<and> real_cte_at x s \<and> real_cte_at src_slot s \<and> ((is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> invs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> pivot_root_cap \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 5. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' a b aa ba ab bb s cap capa capb. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; ex_cte_cap_wp_to is_cnode_cap (ab, bb) s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; invs s; caps_of_state s (ab, bb) = Some cap; caps_of_state s (a, b) = Some capa; caps_of_state s (aa, ba) = Some capb; valid_objs s\<rbrakk> \<Longrightarrow> (ab = aa \<longrightarrow> bb \<noteq> ba) \<and> (ab = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> (aa = a \<and> ba = b \<longrightarrow> capa \<noteq> NullCap \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data capa \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data cap \<noteq> NullCap \<longrightarrow> (is_untyped_cap capa \<longrightarrow> capa = update_cap_data True src_new_data capa) \<and> (is_untyped_cap cap \<longrightarrow> cap = update_cap_data True pivot_new_data cap) \<and> (a = ab \<longrightarrow> b \<noteq> bb)) \<and> ((aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> capa = NullCap \<longrightarrow> capb \<noteq> NullCap \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data capb \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data cap \<noteq> NullCap \<longrightarrow> (is_untyped_cap capb \<longrightarrow> capb = update_cap_data True src_new_data capb) \<and> (is_untyped_cap cap \<longrightarrow> cap = update_cap_data True pivot_new_data cap) \<and> (aa = ab \<longrightarrow> ba \<noteq> bb))
 2. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> True \<and> True \<and> True \<and> (valid_objs and valid_cap pivot_root_cap) s \<and> real_cte_at x s \<and> real_cte_at src_slot s \<and> ((is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> invs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> pivot_root_cap \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 5. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<lbrakk>args = index_ # bits_ # pivot_new_data_ # pivot_index_ # pivot_depth_ # src_new_data_ # src_index_ # src_depth_ # args'_; cs = pivot_root_cap_ # src_root_cap_ # exs'_; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; ex_cte_cap_wp_to is_cnode_cap (ab_, bb_) s_; ex_cte_cap_wp_to is_cnode_cap (a_, b_) s_; invs s_; caps_of_state s_ (ab_, bb_) = Some cap_; caps_of_state s_ (a_, b_) = Some capa_; caps_of_state s_ (aa_, ba_) = Some capb_; valid_objs s_\<rbrakk> \<Longrightarrow> (ab_ = aa_ \<longrightarrow> bb_ \<noteq> ba_) \<and> (ab_ = a_ \<longrightarrow> bb_ \<noteq> b_) \<longrightarrow> (aa_ = a_ \<and> ba_ = b_ \<longrightarrow> capa_ \<noteq> NullCap \<longrightarrow> cap_ \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data_ capa_ \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data_ cap_ \<noteq> NullCap \<longrightarrow> (is_untyped_cap capa_ \<longrightarrow> capa_ = update_cap_data True src_new_data_ capa_) \<and> (is_untyped_cap cap_ \<longrightarrow> cap_ = update_cap_data True pivot_new_data_ cap_) \<and> (a_ = ab_ \<longrightarrow> b_ \<noteq> bb_)) \<and> ((aa_ = a_ \<longrightarrow> ba_ \<noteq> b_) \<longrightarrow> capa_ = NullCap \<longrightarrow> capb_ \<noteq> NullCap \<longrightarrow> cap_ \<noteq> NullCap \<longrightarrow> update_cap_data True src_new_data_ capb_ \<noteq> NullCap \<longrightarrow> update_cap_data True pivot_new_data_ cap_ \<noteq> NullCap \<longrightarrow> (is_untyped_cap capb_ \<longrightarrow> capb_ = update_cap_data True src_new_data_ capb_) \<and> (is_untyped_cap cap_ \<longrightarrow> cap_ = update_cap_data True pivot_new_data_ cap_) \<and> (aa_ = ab_ \<longrightarrow> ba_ \<noteq> bb_)) proof (prove)
goal (4 subgoals):
 1. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> True \<and> True \<and> True \<and> (valid_objs and valid_cap pivot_root_cap) s \<and> real_cte_at x s \<and> real_cte_at src_slot s \<and> ((is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> invs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> pivot_root_cap \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 4. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' x\<rbrace> lookup_slot_for_cnode_op True src_root_cap (data_to_cptr src_index) (data_to_nat src_depth) \<lbrace>\<lambda>src_slot s. True \<and> True \<and> True \<and> True \<and> (valid_objs and valid_cap pivot_root_cap) s \<and> real_cte_at x s \<and> real_cte_at src_slot s \<and> ((is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> ex_cte_cap_wp_to is_cnode_cap x s \<and> invs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits) \<lbrace>?B706 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> pivot_root_cap \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> ?P'702 cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 4. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>cap index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi = CNodeRotate; (invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. s \<turnstile> pivot_root_cap \<and> s \<turnstile> src_root_cap \<and> (\<forall>cap\<in>set exs'. s \<turnstile> cap)) and (\<lambda>s. (is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (is_cnode_cap src_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs src_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set exs'. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)))) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (valid_objs and valid_cap pivot_root_cap) s \<and> (valid_objs and valid_cap cap) s \<and> (valid_objs and valid_cap src_root_cap) s \<and> ((is_cnode_cap pivot_root_cap \<longrightarrow> (\<forall>r\<in>cte_refs pivot_root_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> ((is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> invs s
 2. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type mi \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type mi = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> decode_cnode_invocation mi args cap cs \<lbrace>valid_cnode_inv\<rbrace>, - proof (prove)
goal (14 subgoals):
 1. \<And>cap. gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> throwError IllegalOperation \<lbrace>valid_cnode_inv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>cap. args = [] \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE y <- whenE (gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller]) (throwError IllegalOperation);
throwError TruncatedMessage
odE \<lbrace>valid_cnode_inv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap x. args = [x] \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE y <- whenE (gen_invocation_type mi \<notin> set [CNodeRevoke .e. CNodeSaveCaller]) (throwError IllegalOperation);
throwError TruncatedMessage
odE \<lbrace>valid_cnode_inv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap index bits args'. \<lbrakk>args = [index, bits]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; args' = []; gen_invocation_type mi \<noteq> CNodeRevoke; gen_invocation_type mi \<noteq> CNodeDelete; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
throwError TruncatedMessage
odE \<lbrace>valid_cnode_inv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap index bits args' x21 x22. \<lbrakk>args = [index, bits, x21]; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<noteq> CNodeRevoke; gen_invocation_type mi \<noteq> CNodeDelete; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; args' = [x21]; x22 = []\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
throwError TruncatedMessage
odE \<lbrace>valid_cnode_inv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap index bits args' x21 x22 x21a x22a. \<lbrakk>args = index # bits # x21 # x21a # x22a; gen_invocation_type mi \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type mi \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi \<noteq> CNodeRevoke; gen_invocation_type mi \<noteq> CNodeDelete; gen_invocation_type mi \<noteq> CNodeCancelBadgedSends; gen_invocation_type mi \<noteq> CNodeRotate; gen_invocation_type mi \<noteq> CNodeSaveCaller; args' = x21 # x21a # x22a; x22 = x21a # x22a; cs = []\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
throwError TruncatedMessage
odE \<lbrace>valid_cnode_inv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap index bits args'. \<lbrakk>args = [index, bits]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi = CNodeRotate; args' = []\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
throwError TruncatedMessage
odE \<lbrace>valid_cnode_inv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap index bits args' x21 x22. \<lbrakk>args = [index, bits, x21]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi = CNodeRotate; args' = [x21]; x22 = []\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
throwError TruncatedMessage
odE \<lbrace>valid_cnode_inv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap index bits args' x21 x22 x21a x22a. \<lbrakk>args = [index, bits, x21, x21a]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi = CNodeRotate; args' = [x21, x21a]; x22 = [x21a]; x22a = []\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
throwError TruncatedMessage
odE \<lbrace>valid_cnode_inv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>cap index bits args' x21 x22 x21a x22a x21b x22b. \<lbrakk>args = [index, bits, x21, x21a, x21b]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type mi = CNodeRotate; args' = [x21, x21a, x21b]; x22 = [x21a, x21b]; x22a = [x21b]; x22b = []\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap cap and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>cap\<in>set cs. s \<turnstile> cap) and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\<rbrace> doE dest_slot <- lookup_slot_for_cnode_op False cap (data_to_cptr index) (data_to_nat bits);
throwError TruncatedMessage
odE \<lbrace>valid_cnode_inv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal:
No subgoals!