theory CNode_DP

lemma seL4_CNode_Mint_sep:
  "\<lbrace>\<lambda>s.
     \<guillemotleft>root_tcb_id \<mapsto>f tcb \<and>*
     (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>*

     \<comment> \<open>Root CNode.\<close>
     cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
     \<comment> \<open>Client cnode.\<close>
     dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>*

     \<comment> \<open>Cap to the root CNode.\<close>
     (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
     \<comment> \<open>Cap to the client CNode.\<close>
     (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>*
     \<comment> \<open>Cap that the root task has to its own CNode.\<close>
     (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>*
     \<comment> \<open>Cap to be copied, in the root CNode.\<close>
     (cnode_id, src_slot) \<mapsto>c src_cap \<and>*
     \<comment> \<open>Where to copy the cap (in the client CNode).\<close>
     (dest_id, dest_slot) \<mapsto>c NullCap \<and>*
      R\<guillemotright> s \<and>

     valid_src_cap src_cap data \<and>
     one_lvl_lookup cnode_cap 32 root_size \<and>
     one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and>
     one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and>

     \<comment> \<open>We need some word invariants\<close>
     unat src_depth \<le> word_bits \<and>
     0 < unat src_depth \<and>
     unat dest_depth \<le> word_bits \<and>
     0 < unat dest_depth \<and>
     is_tcb tcb \<and>
     is_cnode_cap dest_root_cap \<and>
     is_cnode_cap cnode_cap \<and>
     is_cnode_cap cnode_cap' \<and>
     guard_equal cnode_cap' src_index (unat src_depth) \<and>
     guard_equal dest_root_cap dest_index (unat dest_depth) \<and>
     guard_equal cnode_cap src_root word_bits \<and>
     guard_equal cnode_cap dest_root word_bits \<and>


     \<comment> \<open>Caps point to the right objects.\<close>
     cap_object cnode_cap = cnode_id \<and>
     cap_object cnode_cap' = cnode_id \<and>
     cap_object dest_root_cap = dest_id \<and>

     \<comment> \<open>Cap slots match their cptrs.\<close>
     dest_root_slot = offset dest_root root_size \<and>
     cnode_cap_slot = offset src_root root_size \<and>
     src_slot = offset src_index root_size \<and>
     dest_slot = offset dest_index dest_size \<and>

     cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and>
     (is_ep_cap src_cap \<or> is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and>
     cap_has_type src_cap \<and> \<not> is_untyped_cap src_cap
  \<rbrace>
  seL4_CNode_Mint dest_root dest_index dest_depth src_root src_index src_depth rights data
  \<lbrace>\<lambda>_. \<guillemotleft> root_tcb_id \<mapsto>f tcb \<and>*
       cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
       dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>*
       (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
       (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>*
       (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>*
       (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>*
       (cnode_id, src_slot) \<mapsto>c src_cap \<and>*
       (dest_id, dest_slot) \<mapsto>c derived_cap cap' \<and>* R\<guillemotright>\<rbrace>" apply (simp add:seL4_CNode_Mint_def sep_state_projection2_def) apply (rule do_kernel_op_pull_back) apply (rule hoare_name_pre_state) apply (simp add:is_tcb_def split:cdl_object.split_asm) apply (rename_tac cdl_tcb) apply (rule hoare_pre) apply (rule call_kernel_with_intent_allow_error_helper[where check=True,simplified,rotated -1]) apply assumption apply fastforce apply (clarsimp simp:sep_conj_assoc) apply (rule hoare_post_imp[OF _
             set_cap_wp]) apply (sep_select 5,assumption) apply wp[1] apply (rule_tac P = "root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>*
                      (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>*
                      cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
                      dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>*
                      (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
                      (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>*
                      (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>*
                      (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>*
                      (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R"
                      in mark_tcb_intent_error_sep_inv) apply wp[1] apply (rule corrupt_ipc_buffer_sep_inv) apply (rule_tac P = "(\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and>
                          iv = InvokeCNode (InsertCall (derived_cap cap'')
                               (cap_object cnode_cap, offset src_index root_size)
                               (cap_object dest_root_cap,offset dest_index dest_size)))"
        in hoare_gen_asmEx) apply (elim conjE exE) apply simp apply (rule false_e_explode) apply (rule no_exception_conj') apply (wp cnode_insert_cap_cdl_current_thread)[1] apply (rule no_exception_conj') apply (wp)[1] apply (rule hoare_post_impErr) apply (rule_tac R = "(root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* R" for R
          in invoke_cnode_insert_cap') apply simp apply (rule conjI[rotated]) apply (rule sep_any_imp_c'_conj[where cap = RestartCap]) apply (frule sep_map_c_asid_reset[where ptr = "(cap_object dest_root_cap, offset dest_index dest_size)"
          ,OF reset_cap_asid_derived]) apply simp apply (sep_solve) apply sep_solve apply (assumption) apply (rule_tac Q = "\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and>
                cdl_current_domain s = minBound) and
                < (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* Q > and
                K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode
                (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size)
                (cap_object dest_root_cap, offset dest_index dest_size)))" for Q
                in hoare_strengthen_post[rotated]) apply (clarsimp simp:cap_of_insert_call_def) apply (rule conjI) apply (sep_select 2,assumption) apply (rule conjI) apply (drule reset_cap_asid_cap_type) apply (simp) apply (rule_tac x = cap'' in exI) apply (simp add:reset_cap_asid_derived) apply (wp set_cap_wp set_cap_all_scheduable_tcbs)[1] apply (rule_tac P = "is_cnode_cap (fst (c,ref))" in hoare_gen_asmEx) apply (clarsimp simp: decode_invocation_simps split_def) apply (rule liftME_wp) apply (rule decode_cnode_mint_rvu) apply (simp add:lookup_extra_caps_def mapME_def sequenceE_def get_index_def) apply (rule wp_no_exception_seq) apply wp[1] apply clarsimp apply (rule lookup_cap_and_slot_rvu[where r = root_size and
    cap = cnode_cap and cap'=cnode_cap']) apply (rule hoare_pre) apply (rule lookup_cap_and_slot_rvu[where r = root_size and
    cap = cnode_cap and cap' = dest_root_cap]) defer apply (clarsimp simp:Let_def) apply (wp hoare_vcg_ball_lift
              sep_inv_to_all_scheduable_tcbs[OF update_thread_intent_update]
              hoare_vcg_imp_lift hoare_vcg_ex_lift hoare_vcg_all_lift
              is_cnode_cap_guard_equal update_thread_intent_update update_thread_cnode_at
            | clarsimp)+ apply (intro conjI impI) apply (sep_solve) apply sep_solve apply (clarsimp simp:conj_comms cnode_non_ep) apply (thin_tac "(P \<and>* Q) (sep_state_projection sa)" for P Q) apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def) apply (intro conjI impI allI, simp_all) apply (clarsimp simp:sep_conj_assoc) apply sep_solve apply (frule reset_cap_asid_cnode_cap) apply clarsimp apply (simp add: cnode_cap_non_ep_related get_index_def)[1] apply (clarsimp simp:sep_conj_assoc) apply sep_solve apply (clarsimp dest!: reset_cap_asid_cnode_cap) apply sep_solve apply clarsimp+ apply (fastforce cong: cap_type_bad_cong dest!: reset_cap_asid_cnode_cap)+ apply (drule(1) reset_cap_asid_cnode_cap | simp)+ apply (clarsimp simp:sep_conj_assoc) apply sep_solve apply (clarsimp dest!:reset_cap_asid_cnode_cap) apply (clarsimp dest!:reset_cap_asid_cnode_cap) apply (metis reset_cap_asid_update_cap_data reset_cap_asid_update_cap_rights) apply (sep_solve) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. Separation_SD.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<or> is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrace> seL4_CNode_Mint dest_root dest_index dest_depth src_root src_index src_depth rights data \<lbrace>\<lambda>_. Separation_SD.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c derived_cap cap' \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c derived_cap cap' \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c derived_cap cap' \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType \<Longrightarrow> \<lbrace>(=) s\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c derived_cap cap' \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 s cdl_tcb\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)\<rbrace>
 2. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> ?Q68 s cdl_tcb sa proof (prove)
goal (14 subgoals):
 1. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; ?Pd2.71 s cdl_tcb sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op71 s cdl_tcb) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr71 s cdl_tcb \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = ?intent_extra71 s cdl_tcb
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?R71 s cdl_tcb\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ra71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>_. ?R71 s cdl_tcb\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Ra71 s cdl_tcb\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 8. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV71 s cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb71 s cdl_tcb sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op71 s cdl_tcb) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.71 s cdl_tcb sa\<rbrace>
 9. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV71 s cdl_tcb iv\<rbrace>
 10. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (?intent_op71 s cdl_tcb) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror71 s cdl_tcb sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op71 s cdl_tcb) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr71 s cdl_tcb \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = ?intent_extra71 s cdl_tcb
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?R71 s cdl_tcb\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ra71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>_. ?R71 s cdl_tcb\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Ra71 s cdl_tcb\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 7. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV71 s cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb71 s cdl_tcb sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op71 s cdl_tcb) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace>
 8. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV71 s cdl_tcb iv\<rbrace>
 9. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (?intent_op71 s cdl_tcb) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror71 s cdl_tcb sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 10. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id (?intent_extra71 s cdl_tcb) \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?R71 s cdl_tcb\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)\<rbrace>
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ra71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>_. ?R71 s cdl_tcb\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Ra71 s cdl_tcb\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 6. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV71 s cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb71 s cdl_tcb sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace>
 7. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV71 s cdl_tcb iv\<rbrace>
 8. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror71 s cdl_tcb sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 9. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 10. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s cdl_tcb type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?R71 s cdl_tcb\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)\<rbrace>
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ra71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>_. ?R71 s cdl_tcb\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Ra71 s cdl_tcb\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 6. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV71 s cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb71 s cdl_tcb sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace>
 7. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV71 s cdl_tcb iv\<rbrace>
 8. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror71 s cdl_tcb sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 9. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 10. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s cdl_tcb type rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* ?R194 s cdl_tcb) sa\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) sa
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ra71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>_. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R194 s cdl_tcb)\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Ra71 s cdl_tcb\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 6. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV71 s cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb71 s cdl_tcb sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace>
 7. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV71 s cdl_tcb iv\<rbrace>
 8. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror71 s cdl_tcb sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 9. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 10. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ra71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>_. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)\<rbrace>
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Ra71 s cdl_tcb\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 5. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV71 s cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb71 s cdl_tcb sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace>
 6. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV71 s cdl_tcb iv\<rbrace>
 7. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror71 s cdl_tcb sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 8. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 9. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 10. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror71 s cdl_tcb\<rbrace>
 4. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV71 s cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb71 s cdl_tcb sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace>
 5. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV71 s cdl_tcb iv\<rbrace>
 6. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror71 s cdl_tcb sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 7. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 8. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> ?Perror71 s cdl_tcb sa\<rbrace>
 10. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb71 s cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)\<rbrace>
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R)\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R)\<rbrace>
 3. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV71 s cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb71 s cdl_tcb sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 4. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV71 s cdl_tcb iv\<rbrace>
 5. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R)\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R)\<rbrace>
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV71 s cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 3. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV71 s cdl_tcb iv\<rbrace>
 4. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV71 s cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV71 s cdl_tcb iv\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; \<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))\<rbrakk> \<Longrightarrow> \<lbrace>?P'207 s cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P'207 s cdl_tcb iv and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb iv cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0; is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0; cap_type src_cap \<noteq> Some UntypedType; reset_cap_asid cap'' = reset_cap_asid cap'; iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'207 s cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P'207 s cdl_tcb iv and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb iv cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'207 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = dest_root \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [src_root] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P'207 s cdl_tcb iv and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb iv cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'207 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ _. False\<rbrace>
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P'207 s cdl_tcb iv and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s cdl_tcb iv cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'244 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id\<rbrace>, -
 2. \<And>s cdl_tcb iv cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P246 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 3. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P246 s cdl_tcb iv and ?P'244 s cdl_tcb iv and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb iv cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P246 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P246 s cdl_tcb iv and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s cdl_tcb iv cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'258 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound\<rbrace>, -
 2. \<And>s cdl_tcb iv cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P260 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P260 s cdl_tcb iv and ?P'258 s cdl_tcb iv and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb iv cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P260 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P260 s cdl_tcb iv and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s cdl_tcb iv cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P260 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)) \<lbrace>?Q269 s cdl_tcb iv cap'' type\<rbrace>, \<lbrace>?E269 s cdl_tcb iv cap'' type\<rbrace>
 2. \<And>s cdl_tcb iv cap'' type rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; ?Q269 s cdl_tcb iv cap'' type rv sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) sa
 3. \<And>s cdl_tcb iv cap'' type e sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; ?E269 s cdl_tcb iv cap'' type e sa\<rbrakk> \<Longrightarrow> False
 4. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P260 s cdl_tcb iv and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s cdl_tcb iv cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size) = InsertCall (?cap274 s cdl_tcb iv cap'' type) (?src_slot274 s cdl_tcb iv cap'' type) (?dest_slot283 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size))))
 2. \<And>s cdl_tcb iv cap'' type rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; cdl.lift (?dest_slot283 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size))) \<mapsto>c ?cap274 s cdl_tcb iv cap'' type \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) sa
 3. \<And>s cdl_tcb iv cap'' type e sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; ?E280 s cdl_tcb iv cap'' type\<rbrakk> \<Longrightarrow> False
 4. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((?dest_slot283 s cdl_tcb iv) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s cdl_tcb iv cap'' type rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap cap'' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) sa
 2. \<And>s cdl_tcb iv cap'' type e sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; ?E280 s cdl_tcb iv cap'' type\<rbrakk> \<Longrightarrow> False
 3. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s cdl_tcb iv cap'' type rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap cap'' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) sa
 2. \<And>s cdl_tcb iv cap'' type rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap cap'' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 3. \<And>s cdl_tcb iv cap'' type e sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; ?E280 s cdl_tcb iv cap'' type\<rbrakk> \<Longrightarrow> False
 4. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s cdl_tcb iv cap'' type rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap cap'' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) sa
 2. \<And>s cdl_tcb iv cap'' type rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap cap'' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 3. \<And>s cdl_tcb iv cap'' type e sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; ?E280 s cdl_tcb iv cap'' type\<rbrakk> \<Longrightarrow> False
 4. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s cdl_tcb iv cap'' type rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap cap'' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))) sa; (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap cap'' = (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap))\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) sa
 2. \<And>s cdl_tcb iv cap'' type rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap cap'' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 3. \<And>s cdl_tcb iv cap'' type e sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; ?E280 s cdl_tcb iv cap'' type\<rbrakk> \<Longrightarrow> False
 4. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s cdl_tcb iv cap'' type sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))) sa; (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap cap'' = (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap))\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R) sa
 2. \<And>s cdl_tcb iv cap'' type rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap cap'' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 3. \<And>s cdl_tcb iv cap'' type e sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; ?E280 s cdl_tcb iv cap'' type\<rbrakk> \<Longrightarrow> False
 4. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra281 s cdl_tcb iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s cdl_tcb iv cap'' type rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap cap'' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 2. \<And>s cdl_tcb iv cap'' type e sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; ?E280 s cdl_tcb iv cap'' type\<rbrakk> \<Longrightarrow> False
 3. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb iv cap'' type e sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cap_object dest_root_cap = dest_id; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); iv = InvokeCNode (InsertCall (derived_cap cap'') (cnode_id, offset src_index root_size) (dest_id, offset dest_index dest_size)); cap_type src_cap = Some type; ?E280 s cdl_tcb iv cap'' type\<rbrakk> \<Longrightarrow> False
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (6 subgoals):
 1. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 2. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 6. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb iv rv sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; ((\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q349 s cdl_tcb iv) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) sa\<rbrakk> \<Longrightarrow> ((\<lambda>a. cdl.lift ((dest_id, offset dest_index dest_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) sa
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q349 s cdl_tcb iv) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb sa cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; valid_src_cap src_cap data; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap 32 root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q349 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) sa; one_lvl_lookup cnode_cap' (unat src_depth) root_size; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa \<and> cap_type cap'' \<noteq> Some UntypedType \<and> (\<exists>cap''a. reset_cap_asid cap''a = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap cap'' = derived_cap cap''a)
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q349 s cdl_tcb iv) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s cdl_tcb sa cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; valid_src_cap src_cap data; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap 32 root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q349 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) sa; one_lvl_lookup cnode_cap' (unat src_depth) root_size; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa
 2. \<And>s cdl_tcb sa cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; valid_src_cap src_cap data; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap 32 root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q349 s cdl_tcb (InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) sa; one_lvl_lookup cnode_cap' (unat src_depth) root_size; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cap_type cap'' \<noteq> Some UntypedType \<and> (\<exists>cap''a. reset_cap_asid cap''a = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap cap'' = derived_cap cap''a)
 3. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q349 s cdl_tcb iv) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb sa cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; valid_src_cap src_cap data; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap 32 root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat src_depth) root_size; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cap_type cap'' \<noteq> Some UntypedType \<and> (\<exists>cap''a. reset_cap_asid cap''a = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap cap'' = derived_cap cap''a)
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s cdl_tcb sa cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; valid_src_cap src_cap data; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap 32 root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat src_depth) root_size; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cap_type cap'' \<noteq> Some UntypedType
 2. \<And>s cdl_tcb sa cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; valid_src_cap src_cap data; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap 32 root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat src_depth) root_size; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<exists>cap''a. reset_cap_asid cap''a = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap cap'' = derived_cap cap''a
 3. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s cdl_tcb sa cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; valid_src_cap src_cap data; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap 32 root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type; cap_type cap'' = cap_type (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap))\<rbrakk> \<Longrightarrow> cap_type cap'' \<noteq> Some UntypedType
 2. \<And>s cdl_tcb sa cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; valid_src_cap src_cap data; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap 32 root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat src_depth) root_size; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<exists>cap''a. reset_cap_asid cap''a = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap cap'' = derived_cap cap''a
 3. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb sa cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; valid_src_cap src_cap data; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap 32 root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat src_depth) root_size; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<exists>cap''a. reset_cap_asid cap''a = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap cap'' = derived_cap cap''a
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s cdl_tcb sa cap'' type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; valid_src_cap src_cap data; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap 32 root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat src_depth) root_size; reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)); one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap cap'' = derived_cap cap''
 2. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (6 subgoals):
 1. \<And>s cdl_tcb iv. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps71 s cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 2. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>?Ps71 s cdl_tcb\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 6. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd71 s cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) s \<and> K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) s\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd71 s cdl_tcb xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>s cdl_tcb c ref cs. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; is_cnode_cap (fst (c, ref))\<rbrakk> \<Longrightarrow> \<lbrace>?P'425 s cdl_tcb c ref cs\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) s \<and> K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid cap' \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) s\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?P'425 s cdl_tcb (fst uu_) (snd uu_) xa and K (is_cnode_cap (fst (fst uu_, snd uu_)))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>s cdl_tcb c a b cs type. \<lbrakk>tcb = Tcb cdl_tcb; is_cnode_cap c; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'425 s cdl_tcb c (a, b) cs\<rbrace> liftME InvokeCNode (decode_cnode_invocation c (a, b) cs (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) s \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> iv = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?P'425 s cdl_tcb (fst uu_) (snd uu_) xa and K (is_cnode_cap (fst (fst uu_, snd uu_)))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>s cdl_tcb c a b cs type. \<lbrakk>tcb = Tcb cdl_tcb; is_cnode_cap c; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'425 s cdl_tcb c (a, b) cs\<rbrace> decode_cnode_invocation c (a, b) cs (CNodeMintIntent dest_index dest_depth src_index src_depth rights data) \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) s \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> InvokeCNode r = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?P'425 s cdl_tcb (fst uu_) (snd uu_) xa and K (is_cnode_cap (fst (fst uu_, snd uu_)))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (4 subgoals):
 1. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. (\<lambda>a. xa \<noteq> [] \<and> cap_has_type (?src_cap503 s cdl_tcb (fst uu_) (snd uu_) xa) \<and> valid_src_cap (?src_cap502 s cdl_tcb (fst uu_) (snd uu_) xa) data \<and> (is_ep_cap (?src_cap501 s cdl_tcb (fst uu_) (snd uu_) xa) \<or> is_ntfn_cap (?src_cap500 s cdl_tcb (fst uu_) (snd uu_) xa) \<longrightarrow> cap_badge (?src_cap499 s cdl_tcb (fst uu_) (snd uu_) xa) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap498 s cdl_tcb (fst uu_) (snd uu_) xa) \<longrightarrow> (let x = update_cap_data_det data (update_cap_rights (cap_rights (?src_cap497 s cdl_tcb (fst uu_) (snd uu_) xa) \<inter> rights) src_cap') in cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) a \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> InvokeCNode (InsertCall (derived_cap x) (cap_object (fst $ the $ get_index xa 0), offset src_index (?src_sz496 s cdl_tcb (fst uu_) (snd uu_) xa)) (cap_object (fst uu_), offset dest_index (?dest_sz495 s cdl_tcb (fst uu_) (snd uu_) xa))) = InvokeCNode (InsertCall (derived_cap cap'') (cap_object cnode_cap, offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))))) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> cdl.lift (\<box> (?src_sz493 s cdl_tcb (fst uu_) (snd uu_) xa, unat src_depth) : fst (the $ get_index xa 0) src_index \<mapsto>u ?src_cap491 s cdl_tcb (fst uu_) (snd uu_) xa \<and>* \<box> (?dest_sz489 s cdl_tcb (fst uu_) (snd uu_) xa, unat dest_depth) : fst uu_ dest_index \<mapsto>u NullCap \<and>* ?R487 s cdl_tcb (fst uu_) (snd uu_) xa) a \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a) and K (is_cnode_cap (fst (fst uu_, snd uu_)))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 4. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) proof (prove)
goal (4 subgoals):
 1. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> doE x <- lookup_cap_and_slot root_tcb_id src_root;
returnOk [x]
odE \<lbrace>\<lambda>xa sa. xa \<noteq> [] \<and> cap_has_type (?src_cap503 s cdl_tcb (fst uu_) (snd uu_) xa) \<and> valid_src_cap (?src_cap502 s cdl_tcb (fst uu_) (snd uu_) xa) data \<and> (is_ep_cap (?src_cap501 s cdl_tcb (fst uu_) (snd uu_) xa) \<longrightarrow> cap_badge (?src_cap499 s cdl_tcb (fst uu_) (snd uu_) xa) = 0) \<and> (is_ntfn_cap (?src_cap500 s cdl_tcb (fst uu_) (snd uu_) xa) \<longrightarrow> cap_badge (?src_cap499 s cdl_tcb (fst uu_) (snd uu_) xa) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap498 s cdl_tcb (fst uu_) (snd uu_) xa) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c - \<and>* ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap497 s cdl_tcb (fst uu_) (snd uu_) xa) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst (the (if xa \<noteq> [] then Some (xa ! 0) else None))) = cnode_id \<and> offset src_index (?src_sz496 s cdl_tcb (fst uu_) (snd uu_) xa) = offset src_index root_size \<and> cap_object (fst uu_) = dest_id \<and> offset dest_index (?dest_sz495 s cdl_tcb (fst uu_) (snd uu_) xa) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz493 s cdl_tcb (fst uu_) (snd uu_) xa, unat src_depth) : fst (the (if xa \<noteq> [] then Some (xa ! 0) else None)) src_index \<mapsto>u ?src_cap491 s cdl_tcb (fst uu_) (snd uu_) xa \<and>* \<box> (?dest_sz489 s cdl_tcb (fst uu_) (snd uu_) xa, unat dest_depth) : fst uu_ dest_index \<mapsto>u NullCap \<and>* ?R487 s cdl_tcb (fst uu_) (snd uu_) xa) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> is_cnode_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 4. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) proof (prove)
goal (5 subgoals):
 1. \<And>s cdl_tcb uu_ uua_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P'508 s cdl_tcb uu_ uua_\<rbrace> returnOk [uua_] \<lbrace>\<lambda>xa sa. xa \<noteq> [] \<and> cap_has_type (?src_cap503 s cdl_tcb (fst uu_) (snd uu_) xa) \<and> valid_src_cap (?src_cap502 s cdl_tcb (fst uu_) (snd uu_) xa) data \<and> (is_ep_cap (?src_cap501 s cdl_tcb (fst uu_) (snd uu_) xa) \<longrightarrow> cap_badge (?src_cap499 s cdl_tcb (fst uu_) (snd uu_) xa) = 0) \<and> (is_ntfn_cap (?src_cap500 s cdl_tcb (fst uu_) (snd uu_) xa) \<longrightarrow> cap_badge (?src_cap499 s cdl_tcb (fst uu_) (snd uu_) xa) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap498 s cdl_tcb (fst uu_) (snd uu_) xa) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c - \<and>* ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap497 s cdl_tcb (fst uu_) (snd uu_) xa) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst (the (if xa \<noteq> [] then Some (xa ! 0) else None))) = cnode_id \<and> offset src_index (?src_sz496 s cdl_tcb (fst uu_) (snd uu_) xa) = offset src_index root_size \<and> cap_object (fst uu_) = dest_id \<and> offset dest_index (?dest_sz495 s cdl_tcb (fst uu_) (snd uu_) xa) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz493 s cdl_tcb (fst uu_) (snd uu_) xa, unat src_depth) : fst (the (if xa \<noteq> [] then Some (xa ! 0) else None)) src_index \<mapsto>u ?src_cap491 s cdl_tcb (fst uu_) (snd uu_) xa \<and>* \<box> (?dest_sz489 s cdl_tcb (fst uu_) (snd uu_) xa, unat dest_depth) : fst uu_ dest_index \<mapsto>u NullCap \<and>* ?R487 s cdl_tcb (fst uu_) (snd uu_) xa) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> is_cnode_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 2. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_cap_and_slot root_tcb_id src_root \<lbrace>?P'508 s cdl_tcb uu_\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (4 subgoals):
 1. \<And>s cdl_tcb uu_. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb (fst uu_) (snd uu_)\<rbrace> lookup_cap_and_slot root_tcb_id src_root \<lbrace>\<lambda>uua_ a. [uua_] \<noteq> [] \<and> cap_has_type (?src_cap503 s cdl_tcb (fst uu_) (snd uu_) [uua_]) \<and> valid_src_cap (?src_cap502 s cdl_tcb (fst uu_) (snd uu_) [uua_]) data \<and> (is_ep_cap (?src_cap501 s cdl_tcb (fst uu_) (snd uu_) [uua_]) \<longrightarrow> cap_badge (?src_cap499 s cdl_tcb (fst uu_) (snd uu_) [uua_]) = 0) \<and> (is_ntfn_cap (?src_cap500 s cdl_tcb (fst uu_) (snd uu_) [uua_]) \<longrightarrow> cap_badge (?src_cap499 s cdl_tcb (fst uu_) (snd uu_) [uua_]) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap498 s cdl_tcb (fst uu_) (snd uu_) [uua_]) \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c - \<and>* ((dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) a \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap497 s cdl_tcb (fst uu_) (snd uu_) [uua_]) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst (the (if [uua_] \<noteq> [] then Some ([uua_] ! 0) else None))) = cnode_id \<and> offset src_index (?src_sz496 s cdl_tcb (fst uu_) (snd uu_) [uua_]) = offset src_index root_size \<and> cap_object (fst uu_) = dest_id \<and> offset dest_index (?dest_sz495 s cdl_tcb (fst uu_) (snd uu_) [uua_]) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz493 s cdl_tcb (fst uu_) (snd uu_) [uua_], unat src_depth) : fst (the (if [uua_] \<noteq> [] then Some ([uua_] ! 0) else None)) src_index \<mapsto>u ?src_cap491 s cdl_tcb (fst uu_) (snd uu_) [uua_] \<and>* \<box> (?dest_sz489 s cdl_tcb (fst uu_) (snd uu_) [uua_], unat dest_depth) : fst uu_ dest_index \<mapsto>u NullCap \<and>* ?R487 s cdl_tcb (fst uu_) (snd uu_) [uua_]) a \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> is_cnode_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 4. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (4 subgoals):
 1. \<And>s cdl_tcb a aa b type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.71 s cdl_tcb a (aa, b)\<rbrace> lookup_cap_and_slot root_tcb_id src_root \<lbrace>\<lambda>uu_ c. cap_has_type (?src_cap503 s cdl_tcb a (aa, b) [uu_]) \<and> valid_src_cap (?src_cap502 s cdl_tcb a (aa, b) [uu_]) data \<and> (is_ep_cap (?src_cap501 s cdl_tcb a (aa, b) [uu_]) \<longrightarrow> cap_badge (?src_cap499 s cdl_tcb a (aa, b) [uu_]) = 0) \<and> (is_ntfn_cap (?src_cap500 s cdl_tcb a (aa, b) [uu_]) \<longrightarrow> cap_badge (?src_cap499 s cdl_tcb a (aa, b) [uu_]) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap498 s cdl_tcb a (aa, b) [uu_]) \<longrightarrow> cdl_current_thread c = Some root_tcb_id \<and> cdl_current_domain c = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) c \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap497 s cdl_tcb a (aa, b) [uu_]) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst uu_) = cap_object cnode_cap \<and> offset src_index (?src_sz496 s cdl_tcb a (aa, b) [uu_]) = offset src_index root_size \<and> cap_object a = cap_object dest_root_cap \<and> offset dest_index (?dest_sz495 s cdl_tcb a (aa, b) [uu_]) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz493 s cdl_tcb a (aa, b) [uu_], unat src_depth) : fst uu_ src_index \<mapsto>u ?src_cap491 s cdl_tcb a (aa, b) [uu_] \<and>* \<box> (?dest_sz489 s cdl_tcb a (aa, b) [uu_], unat dest_depth) : a dest_index \<mapsto>u NullCap \<and>* ?R487 s cdl_tcb a (aa, b) [uu_]) c \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) c \<and> cdl_current_thread c = Some root_tcb_id \<and> cdl_current_domain c = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) c \<and> is_cnode_cap a\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.71 s cdl_tcb (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 4. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (3 subgoals):
 1. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ((\<forall>c. reset_cap_asid c = reset_cap_asid cnode_cap' \<longrightarrow> cap_has_type (?src_cap589 s cdl_tcb (fst uu_) (snd uu_) c) \<and> valid_src_cap (?src_cap588 s cdl_tcb (fst uu_) (snd uu_) c) data \<and> (is_ep_cap (?src_cap587 s cdl_tcb (fst uu_) (snd uu_) c) \<longrightarrow> cap_badge (?src_cap586 s cdl_tcb (fst uu_) (snd uu_) c) = 0) \<and> (is_ntfn_cap (?src_cap585 s cdl_tcb (fst uu_) (snd uu_) c) \<longrightarrow> cap_badge (?src_cap584 s cdl_tcb (fst uu_) (snd uu_) c) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap583 s cdl_tcb (fst uu_) (snd uu_) c) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap582 s cdl_tcb (fst uu_) (snd uu_) c) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst (c, cap_object cnode_cap, offset src_root root_size)) = cap_object cnode_cap \<and> offset src_index (?src_sz581 s cdl_tcb (fst uu_) (snd uu_) c) = offset src_index root_size \<and> cap_object (fst uu_) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz580 s cdl_tcb (fst uu_) (snd uu_) c) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz579 s cdl_tcb (fst uu_) (snd uu_) c, unat src_depth) : fst (c, cap_object cnode_cap, offset src_root root_size) src_index \<mapsto>u ?src_cap578 s cdl_tcb (fst uu_) (snd uu_) c \<and>* \<box> (?dest_sz577 s cdl_tcb (fst uu_) (snd uu_) c, unat dest_depth) : fst uu_ dest_index \<mapsto>u NullCap \<and>* ?R576 s cdl_tcb (fst uu_) (snd uu_) c) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> is_cnode_cap (fst uu_)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* ?R574 s cdl_tcb (fst uu_) (snd uu_)) sa) \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 3. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_cap589 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap503 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap588 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap502 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap587 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap501 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap586 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap585 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap500 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap584 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap583 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap498 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap582 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap497 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap578 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap491 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (4 subgoals):
 1. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q590 s cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ((\<forall>c. reset_cap_asid c = reset_cap_asid cnode_cap' \<longrightarrow> cap_has_type (?src_cap589 s cdl_tcb (fst uu_) (snd uu_) c) \<and> valid_src_cap (?src_cap588 s cdl_tcb (fst uu_) (snd uu_) c) data \<and> (is_ep_cap (?src_cap587 s cdl_tcb (fst uu_) (snd uu_) c) \<longrightarrow> cap_badge (?src_cap586 s cdl_tcb (fst uu_) (snd uu_) c) = 0) \<and> (is_ntfn_cap (?src_cap585 s cdl_tcb (fst uu_) (snd uu_) c) \<longrightarrow> cap_badge (?src_cap584 s cdl_tcb (fst uu_) (snd uu_) c) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap583 s cdl_tcb (fst uu_) (snd uu_) c) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap582 s cdl_tcb (fst uu_) (snd uu_) c) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst (c, cap_object cnode_cap, offset src_root root_size)) = cap_object cnode_cap \<and> offset src_index (?src_sz581 s cdl_tcb (fst uu_) (snd uu_) c) = offset src_index root_size \<and> cap_object (fst uu_) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz580 s cdl_tcb (fst uu_) (snd uu_) c) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz579 s cdl_tcb (fst uu_) (snd uu_) c, unat src_depth) : fst (c, cap_object cnode_cap, offset src_root root_size) src_index \<mapsto>u ?src_cap578 s cdl_tcb (fst uu_) (snd uu_) c \<and>* \<box> (?dest_sz577 s cdl_tcb (fst uu_) (snd uu_) c, unat dest_depth) : fst uu_ dest_index \<mapsto>u NullCap \<and>* ?R576 s cdl_tcb (fst uu_) (snd uu_) c) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> is_cnode_cap (fst uu_)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* ?R574 s cdl_tcb (fst uu_) (snd uu_)) sa) \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> ?Q590 s cdl_tcb sa
 3. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 4. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_cap589 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap503 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap588 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap502 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap587 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap501 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap586 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap585 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap500 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap584 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap583 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap498 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap582 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap497 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap578 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap491 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (3 subgoals):
 1. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cap_has_type (?src_cap589 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<and> valid_src_cap (?src_cap588 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) data \<and> (is_ep_cap (?src_cap587 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap586 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (is_ntfn_cap (?src_cap585 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap584 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap583 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap582 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst (ca, cap_object cnode_cap, offset src_root root_size)) = cap_object cnode_cap \<and> offset src_index (?src_sz581 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object cnode_cap, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz580 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz579 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat src_depth) : fst (ca, cap_object cnode_cap, offset src_root root_size) src_index \<mapsto>u ?src_cap578 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz577 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object cnode_cap, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R576 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> is_cnode_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* ?R574 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* ?R593 s cdl_tcb) sa
 2. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 3. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_cap589 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap503 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap588 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap502 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap587 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap501 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap586 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap585 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap500 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap584 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap583 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap498 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap582 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap497 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap578 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap491 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (3 subgoals):
 1. \<And>s cdl_tcb. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 2. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa
 3. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cap_has_type (?src_cap589 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<and> valid_src_cap (?src_cap588 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) data \<and> (is_ep_cap (?src_cap587 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap586 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (is_ntfn_cap (?src_cap585 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap584 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap583 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap582 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst (ca, cap_object cnode_cap, offset src_root root_size)) = cap_object cnode_cap \<and> offset src_index (?src_sz581 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object cnode_cap, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz580 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz579 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat src_depth) : fst (ca, cap_object cnode_cap, offset src_root root_size) src_index \<mapsto>u ?src_cap578 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz577 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object cnode_cap, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R576 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> is_cnode_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* ?R574 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* ?R593 s cdl_tcb) sa
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_cap589 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap503 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap588 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap502 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap587 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap501 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap586 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap585 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap500 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap584 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap583 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap498 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap582 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap497 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap578 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap491 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (3 subgoals):
 1. \<And>s cdl_tcb type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P71 s cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 2. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMintIntent dest_index dest_depth src_index src_depth rights data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P71 s cdl_tcb sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa
 3. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cap_has_type (?src_cap589 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<and> valid_src_cap (?src_cap588 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) data \<and> (is_ep_cap (?src_cap587 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap586 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (is_ntfn_cap (?src_cap585 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap584 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap583 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap582 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst (ca, cap_object cnode_cap, offset src_root root_size)) = cap_object cnode_cap \<and> offset src_index (?src_sz581 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object cnode_cap, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz580 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz579 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat src_depth) : fst (ca, cap_object cnode_cap, offset src_root root_size) src_index \<mapsto>u ?src_cap578 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz577 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object cnode_cap, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R576 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> is_cnode_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* ?R574 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* ?R593 s cdl_tcb) sa
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_cap589 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap503 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap588 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap502 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap587 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap501 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap586 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap585 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap500 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap584 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap583 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap498 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap582 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap497 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap578 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap491 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb sa type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 sa cdl_tcb) \<and>* (\<lambda>s. True)) sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 sa cdl_tcb) \<and>* (\<lambda>s. True)) sa
 2. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cap_has_type (?src_cap589 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<and> valid_src_cap (?src_cap588 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) data \<and> (is_ep_cap (?src_cap587 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap586 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (is_ntfn_cap (?src_cap585 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap584 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap583 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap582 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst (ca, cap_object cnode_cap, offset src_root root_size)) = cap_object cnode_cap \<and> offset src_index (?src_sz581 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object cnode_cap, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz580 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz579 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat src_depth) : fst (ca, cap_object cnode_cap, offset src_root root_size) src_index \<mapsto>u ?src_cap578 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz577 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object cnode_cap, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R576 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> is_cnode_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* ?R574 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* ?R593 s cdl_tcb) sa
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_cap589 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap503 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap588 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap502 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap587 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap501 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap586 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap585 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap500 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap584 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap583 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap498 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap582 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap497 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap578 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap491 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb sa type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 sa cdl_tcb) \<and>* (\<lambda>s. True)) sa
 2. \<And>cdl_tcb sa type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 sa cdl_tcb) \<and>* (\<lambda>s. True)) sa
 3. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb71 s cdl_tcb) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cap_has_type (?src_cap589 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<and> valid_src_cap (?src_cap588 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) data \<and> (is_ep_cap (?src_cap587 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap586 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (is_ntfn_cap (?src_cap585 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap584 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap583 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap582 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst (ca, cap_object cnode_cap, offset src_root root_size)) = cap_object cnode_cap \<and> offset src_index (?src_sz581 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object cnode_cap, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz580 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz579 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat src_depth) : fst (ca, cap_object cnode_cap, offset src_root root_size) src_index \<mapsto>u ?src_cap578 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz577 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object cnode_cap, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R576 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> is_cnode_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* ?R574 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* ?R593 s cdl_tcb) sa
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_cap589 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap503 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap588 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap502 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap587 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap501 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap586 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap585 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap500 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap584 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap583 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap498 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap582 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap497 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap578 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap491 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb sa type. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; valid_src_cap src_cap data; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) sa
 2. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cap_has_type (?src_cap589 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<and> valid_src_cap (?src_cap588 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) data \<and> (is_ep_cap (?src_cap587 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap586 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (is_ntfn_cap (?src_cap585 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap584 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap583 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap582 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst (ca, cap_object cnode_cap, offset src_root root_size)) = cap_object cnode_cap \<and> offset src_index (?src_sz581 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object cnode_cap, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz580 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz579 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat src_depth) : fst (ca, cap_object cnode_cap, offset src_root root_size) src_index \<mapsto>u ?src_cap578 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz577 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object cnode_cap, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R576 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> is_cnode_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* ?R574 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* ?R593 s cdl_tcb) sa
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_cap589 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap503 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap588 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap502 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap587 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap501 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap586 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap585 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap500 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap584 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap583 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap498 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap582 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap497 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap578 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap491 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (1 subgoal):
 1. \<And>s cdl_tcb sa. \<lbrakk>tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> valid_src_cap src_cap data \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap) \<and> (is_ep_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> (is_ntfn_cap src_cap \<longrightarrow> cap_badge src_cap = 0) \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (dest_id, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cap_has_type (?src_cap589 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<and> valid_src_cap (?src_cap588 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) data \<and> (is_ep_cap (?src_cap587 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap586 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (is_ntfn_cap (?src_cap585 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cap_badge (?src_cap584 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = 0) \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap583 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap582 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) \<inter> rights) src_cap')) = derived_cap cap'' \<and> cap_object (fst (ca, cap_object cnode_cap, offset src_root root_size)) = cap_object cnode_cap \<and> offset src_index (?src_sz581 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object cnode_cap, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz580 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> cdl.lift (\<box> (?src_sz579 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat src_depth) : fst (ca, cap_object cnode_cap, offset src_root root_size) src_index \<mapsto>u ?src_cap578 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz577 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object cnode_cap, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R576 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size)) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> is_cnode_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* ?R574 s cdl_tcb (fst (c, cap_object cnode_cap, offset dest_root root_size)) (snd (c, cap_object cnode_cap, offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* ?R593 s cdl_tcb) sa
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_cap589 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap503 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap588 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap502 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap587 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap501 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap586 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap585 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap500 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap584 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap583 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap498 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap582 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap497 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap578 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap491 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (1 subgoal):
 1. \<And>s cdl_tcb sa type. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* ?R593 s cdl_tcb) sa \<and> (\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> \<not> ep_related_cap c \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* ?R574 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size)) sa \<and> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> is_cnode_cap c \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> valid_src_cap (?src_cap588 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) data \<and> cap_has_type (?src_cap589 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> (is_ntfn_cap (?src_cap585 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cap_badge (?src_cap584 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = 0) \<and> (is_ep_cap (?src_cap587 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cap_badge (?src_cap586 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = 0) \<and> cdl.lift (\<box> (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap578 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R576 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) sa \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap583 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cap_object c = cap_object dest_root_cap \<and> cap_object ca = cap_object cnode_cap \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> offset dest_index (?dest_sz580 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size \<and> offset src_index (?src_sz581 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap582 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<inter> rights) src_cap')) = derived_cap cap'') \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa)))
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_cap589 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap503 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap588 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap502 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap587 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap501 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap586 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap585 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap500 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap584 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap583 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap498 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap582 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap497 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap578 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap491 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (1 subgoal):
 1. \<And>s cdl_tcb sa type. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* ?R593 s cdl_tcb) sa \<and> (\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> \<not> ep_related_cap c \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* ?R574 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size)) sa \<and> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> is_cnode_cap c \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> valid_src_cap (?src_cap588 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) data \<and> cap_has_type (?src_cap589 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> (is_ntfn_cap (?src_cap585 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cap_badge (?src_cap584 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = 0) \<and> (is_ep_cap (?src_cap587 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cap_badge (?src_cap586 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = 0) \<and> cdl.lift (\<box> (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap578 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R576 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) sa \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap583 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cap_object c = cap_object dest_root_cap \<and> cap_object ca = cap_object cnode_cap \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> offset dest_index (?dest_sz580 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size \<and> offset src_index (?src_sz581 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap582 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<inter> rights) src_cap')) = derived_cap cap'') \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa)))
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_cap589 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap503 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap588 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap502 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap587 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap501 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap586 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap585 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap500 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap584 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap583 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap498 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap582 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap497 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap578 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap491 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (1 subgoal):
 1. \<And>s cdl_tcb sa type. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap) \<and>* ?R593 s cdl_tcb) sa \<and> (\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> \<not> ep_related_cap c \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap') \<and>* ?R574 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size)) sa \<and> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> is_cnode_cap c \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> valid_src_cap (?src_cap588 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) data \<and> cap_has_type (?src_cap589 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> (is_ntfn_cap (?src_cap585 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cap_badge (?src_cap584 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = 0) \<and> (is_ep_cap (?src_cap587 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cap_badge (?src_cap586 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = 0) \<and> one_lvl_lookup ca (unat src_depth) (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> guard_equal ca src_index (unat src_depth) \<and> is_cnode_cap ca \<and> one_lvl_lookup c (unat dest_depth) (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> guard_equal c dest_index (unat dest_depth) \<and> is_cnode_cap c \<and> cdl.lift ((cap_object ca \<mapsto>f CNode (empty_cnode (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)) \<and>* (cap_object ca, offset src_index (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)) \<mapsto>c ?src_cap578 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<and>* (cap_object c \<mapsto>f CNode (empty_cnode (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)) \<and>* (cap_object c, offset dest_index (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)) \<mapsto>c NullCap) \<and>* ?R576 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) sa \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap583 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cap_object c = cap_object dest_root_cap \<and> cap_object ca = cap_object cnode_cap \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> offset dest_index (?dest_sz580 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size \<and> offset src_index (?src_sz581 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights (?src_cap582 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) \<inter> rights) src_cap')) = derived_cap cap'') \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa)))
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_cap589 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap503 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap588 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap502 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap587 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap501 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap586 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap585 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap500 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap584 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap499 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap583 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap498 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap582 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap497 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_cap578 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_cap491 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_cap503 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap502 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap501 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap500 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap499 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap498 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_cap497 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_cap491 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (19 subgoals):
 1. \<And>s cdl_tcb sa type. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap) \<and>* ?R593 s cdl_tcb) sa
 2. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap c
 3. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap') \<and>* ?R574 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size)) sa
 4. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap c
 5. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 6. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cap_has_type src_cap
 7. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ntfn_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 8. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ep_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 9. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup ca (unat src_depth) (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 10. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal ca src_index (unat src_depth)
A total of 19 subgoals...
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (19 subgoals):
 1. \<And>s cdl_tcb sa type. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* ?R593 s cdl_tcb) sa
 2. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap c
 3. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap') \<and>* ?R574 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size)) sa
 4. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap c
 5. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 6. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cap_has_type src_cap
 7. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ntfn_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 8. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ep_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 9. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup ca (unat src_depth) (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 10. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal ca src_index (unat src_depth)
A total of 19 subgoals...
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (18 subgoals):
 1. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap c
 2. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap') \<and>* ?R574 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size)) sa
 3. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap c
 4. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 5. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cap_has_type src_cap
 6. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ntfn_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 7. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ep_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 8. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup ca (unat src_depth) (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 9. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal ca src_index (unat src_depth)
 10. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap ca
A total of 18 subgoals...
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (19 subgoals):
 1. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> is_cnode_cap dest_root_cap
 2. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; c = dest_root_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap c
 3. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap') \<and>* ?R574 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size)) sa
 4. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap c
 5. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 6. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cap_has_type src_cap
 7. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ntfn_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 8. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ep_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 9. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup ca (unat src_depth) (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 10. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal ca src_index (unat src_depth)
A total of 19 subgoals...
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (18 subgoals):
 1. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; c = dest_root_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap c
 2. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap') \<and>* ?R574 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size)) sa
 3. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap c
 4. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 5. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cap_has_type src_cap
 6. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ntfn_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 7. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ep_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 8. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup ca (unat src_depth) (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 9. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal ca src_index (unat src_depth)
 10. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap ca
A total of 18 subgoals...
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (17 subgoals):
 1. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap') \<and>* ?R574 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size)) sa
 2. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap c
 3. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 4. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cap_has_type src_cap
 5. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ntfn_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 6. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ep_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 7. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup ca (unat src_depth) (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 8. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal ca src_index (unat src_depth)
 9. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap ca
 10. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat dest_depth) (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (17 subgoals):
 1. \<And>s cdl_tcb sa type c. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* ?R574 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size)) sa
 2. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap c
 3. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 4. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cap_has_type src_cap
 5. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ntfn_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 6. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ep_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 7. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup ca (unat src_depth) (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 8. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal ca src_index (unat src_depth)
 9. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap ca
 10. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat dest_depth) (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (16 subgoals):
 1. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap c
 2. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 3. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cap_has_type src_cap
 4. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ntfn_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 5. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ep_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 6. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup ca (unat src_depth) (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 7. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal ca src_index (unat src_depth)
 8. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap ca
 9. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat dest_depth) (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 10. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal c dest_index (unat dest_depth)
A total of 16 subgoals...
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (15 subgoals):
 1. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 2. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cap_has_type src_cap
 3. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ntfn_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 4. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ep_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 5. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup ca (unat src_depth) (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 6. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal ca src_index (unat src_depth)
 7. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap ca
 8. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat dest_depth) (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 9. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal c dest_index (unat dest_depth)
 10. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap c
A total of 15 subgoals...
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (14 subgoals):
 1. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cap_has_type src_cap
 2. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ntfn_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 3. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; is_ep_cap src_cap\<rbrakk> \<Longrightarrow> cap_badge src_cap = 0
 4. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup ca (unat src_depth) (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 5. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal ca src_index (unat src_depth)
 6. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap ca
 7. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat dest_depth) (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 8. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal c dest_index (unat dest_depth)
 9. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap c
 10. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object ca \<mapsto>f CNode (empty_cnode (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)) \<and>* (cap_object ca, offset src_index (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)) \<mapsto>c src_cap) \<and>* (cap_object c \<mapsto>f CNode (empty_cnode (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)) \<and>* (cap_object c, offset dest_index (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)) \<mapsto>c NullCap) \<and>* ?R576 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) sa
A total of 14 subgoals...
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (11 subgoals):
 1. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup ca (unat src_depth) (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 2. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal ca src_index (unat src_depth)
 3. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap ca
 4. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat dest_depth) (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)
 5. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal c dest_index (unat dest_depth)
 6. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap c
 7. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object ca \<mapsto>f CNode (empty_cnode (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)) \<and>* (cap_object ca, offset src_index (?src_sz579 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)) \<mapsto>c src_cap) \<and>* (cap_object c \<mapsto>f CNode (empty_cnode (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)) \<and>* (cap_object c, offset dest_index (?dest_sz577 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca)) \<mapsto>c NullCap) \<and>* ?R576 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) sa
 8. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object c = cap_object dest_root_cap
 9. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object ca = cap_object cnode_cap
 10. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> \<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> offset dest_index (?dest_sz580 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size \<and> offset src_index (?src_sz581 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap')) = derived_cap cap''
A total of 11 subgoals...
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?src_sz581 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz496 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz580 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz495 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?src_sz579 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?src_sz493 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?dest_sz577 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?dest_sz489 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>s cdl_tcb c a b. ?src_sz496 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?src_sz493 s cdl_tcb c (a, b)
\<lambda>s cdl_tcb c a b. ?dest_sz495 s cdl_tcb c (a, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb c a b. ?dest_sz489 s cdl_tcb c (a, b) proof (prove)
goal (5 subgoals):
 1. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object ca, offset src_index root_size) \<mapsto>c src_cap) \<and>* (cap_object c \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object c, offset dest_index dest_size) \<mapsto>c NullCap) \<and>* ?R576 s cdl_tcb c (cap_object cnode_cap, offset dest_root root_size) ca) sa
 2. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object c = cap_object dest_root_cap
 3. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object ca = cap_object cnode_cap
 4. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> \<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> offset dest_index dest_size = offset dest_index dest_size \<and> offset src_index root_size = offset src_index root_size \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap')) = derived_cap cap''
 5. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] proof (prove)
goal (5 subgoals):
 1. \<And>s cdl_tcb sa type c ca. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; c = dest_root_cap; ca = cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap) \<and>* (cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap) \<and>* ?R576 s cdl_tcb dest_root_cap (cap_object cnode_cap, offset dest_root root_size) cnode_cap') sa
 2. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object c = cap_object dest_root_cap
 3. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object ca = cap_object cnode_cap
 4. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> \<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> offset dest_index dest_size = offset dest_index dest_size \<and> offset src_index root_size = offset src_index root_size \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap')) = derived_cap cap''
 5. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] proof (prove)
goal (5 subgoals):
 1. \<And>s cdl_tcb sa type. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* ?R576 s cdl_tcb dest_root_cap (cap_object cnode_cap, offset dest_root root_size) cnode_cap') sa
 2. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object c = cap_object dest_root_cap
 3. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object ca = cap_object cnode_cap
 4. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> \<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> offset dest_index dest_size = offset dest_index dest_size \<and> offset src_index root_size = offset src_index root_size \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap')) = derived_cap cap''
 5. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa
flex-flex pairs:
\<lambda>s cdl_tcb a aa b. ?R576 s cdl_tcb a (aa, b) \<equiv>\<^sup>? \<lambda>s cdl_tcb a aa b c. ?R487 s cdl_tcb a (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] proof (prove)
goal (4 subgoals):
 1. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object c = cap_object dest_root_cap
 2. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object ca = cap_object cnode_cap
 3. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> \<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> offset dest_index dest_size = offset dest_index dest_size \<and> offset src_index root_size = offset src_index root_size \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap')) = derived_cap cap''
 4. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa proof (prove)
goal (3 subgoals):
 1. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object ca = cap_object cnode_cap
 2. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> \<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> offset dest_index dest_size = offset dest_index dest_size \<and> offset src_index root_size = offset src_index root_size \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap')) = derived_cap cap''
 3. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa proof (prove)
goal (2 subgoals):
 1. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> \<exists>cap''. reset_cap_asid cap'' = reset_cap_asid (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and> offset dest_index dest_size = offset dest_index dest_size \<and> offset src_index root_size = offset src_index root_size \<and> derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap')) = derived_cap cap''
 2. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s cdl_tcb sa type c ca src_cap'. \<lbrakk>tcb = Tcb cdl_tcb; valid_src_cap src_cap data; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) sa; dest_id = cap_object dest_root_cap; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; dest_root_slot = offset dest_root root_size; dest_slot = offset dest_index dest_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; is_cnode_cap dest_root_cap; guard_equal cnode_cap' src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap' = update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap); type = EndpointType \<longrightarrow> cap_badge src_cap = 0; type = NotificationType \<longrightarrow> cap_badge src_cap = 0; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid dest_root_cap; reset_cap_asid ca = reset_cap_asid cnode_cap'; reset_cap_asid src_cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c derived_cap (update_cap_data_det data (update_cap_rights (cap_rights src_cap \<inter> rights) src_cap)) \<and>* R)) sa proof (prove)
goal:
No subgoals!